blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-4348

MEDIUM 6.1 CVSS 3.1
Published
June 7, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-862, CWE-601
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.

Affected products and versions

  • createit-pl Ultimate GDPR & CCPA Compliance Toolkit for WordPress — Before 2.5
  • createit ultimate_gdpr_\&_ccpa_compliance_toolkit — Before 2.5

References

  • blog.nintechnet.com https://blog.nintechnet.com/critical-vulnerability-in-wordpress-ultimate-gdpr-ccpa-compliance-toolkit-plugin/ Exploit, Technical Description, Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/40e2e8fb-ea36-4602-bead-8daf75d6dfb9?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record