WordPress多个插件和主题 安全漏洞(CVE-2021-4342)

CVE编号

CVE-2021-4342

利用情况

暂无

补丁情况

N/A

披露时间

2023-06-07
漏洞描述
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。
WordPress 多个插件和主题 存在安全漏洞，该漏洞源于随机数保护实施不当，容易受到跨站点请求伪造的攻击。
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 10up elasticpress * Up to
(excluding)
3.5.4
运行在以下环境
应用 10web 10webanalytics * Up to
(excluding)
1.2.9
运行在以下环境
应用 amministrazione_trasparente_project amministrazione_trasparente * Up to
(excluding)
7.1.1
运行在以下环境
应用 analogwp style_kits * Up to
(excluding)
1.8.1
运行在以下环境
应用 ashstonestudios absolute_reviews * Up to
(excluding)
1.0.9
运行在以下环境
应用 ashstonestudios advanced_popups * Up to
(excluding)
1.1.2
运行在以下环境
应用 brainstormforce import_/_export_customizer_settings * Up to
(excluding)
1.0.4
运行在以下环境
应用 brainstormforce lightweight_sidebar_manager * Up to
(excluding)
1.1.4
运行在以下环境
应用 c7style contact_form_7_style * Up to
(including)
3.2
运行在以下环境
应用 cartflows funnel_builder * Up to
(excluding)
1.5.16
运行在以下环境
应用 cm-wp woody_code_snippets * Up to
(excluding)
2.3.10
运行在以下环境
应用 coolplugins cool_timeline * Up to
(excluding)
2.0.3
运行在以下环境
应用 coolplugins process_steps_template_designer * Up to
(excluding)
1.3
运行在以下环境
应用 designwall dw_question_&_answer * Up to
(including)
1.5.7
运行在以下环境
应用 edwiser bridge * Up to
(excluding)
2.0.7
运行在以下环境
应用 eventespresso event_espresso * Up to
(including)
4.10.11.decaf
运行在以下环境
应用 ewww image_optimizer * Up to
(excluding)
5.9.0
运行在以下环境
应用 exportfeed woocommerce_etsy_integration * Up to
(including)
3.3.1
运行在以下环境
应用 flippercode custom_css-js-php * Up to
(including)
2.0.7
运行在以下环境
应用 flippercode photo_gallery_-_image_gallery * Up to
(including)
1.0.6
运行在以下环境
应用 flippercode wp_security_question * Up to
(including)
1.0.5
运行在以下环境
应用 goldplugins custom_banners * Up to
(excluding)
3.3
运行在以下环境
应用 goldplugins easy_testimonials * Up to
(excluding)
3.7
运行在以下环境
应用 goldplugins locations * Up to
(excluding)
4.0
运行在以下环境
应用 goldplugins staff_directory_plugin * Up to
(excluding)
4.0
运行在以下环境
应用 goprayer wp_prayer * Up to
(excluding)
1.6.6
运行在以下环境
应用 graphpaperpress sell_media * Up to
(including)
2.5.5
运行在以下环境
应用 implecode ecommerce_product_catalog * Up to
(excluding)
2.9.44
运行在以下环境
应用 implecode ecommerce_product_catalog * From
(including)
3.0.1 		Up to
(excluding)
3.0.18
运行在以下环境
应用 implecode product_catalog_simple * Up to
(excluding)
1.5.13
运行在以下环境
应用 incsub forminator * Up to
(excluding)
1.13.5
运行在以下环境
应用 incsub forminator * From
(including)
1.14.0 		Up to
(excluding)
1.14.9
运行在以下环境
应用 inoplugs wp-backgrounds_lite * Up to
(including)
2.3
运行在以下环境
应用 jesseeproductions coupon_creator * Up to
(excluding)
3.1.1
运行在以下环境
应用 menu_swapper_project menu_swapper * Up to
(excluding)
1.1.1
运行在以下环境
应用 multiple_roles_project multiple_roles * Up to
(including)
1.3.1
运行在以下环境
应用 multivendorx multivendorx * Up to
(excluding)
3.5.8
运行在以下环境
应用 multivendorx multivendorx * From
(including)
3.5.9 		Up to
(excluding)
3.7.8
运行在以下环境
应用 oceanwp ocean_extra * Up to
(excluding)
1.6.6
运行在以下环境
应用 paidmembershipspro paid_memberships_pro * Up to
(excluding)
2.4.3
运行在以下环境
应用 presscustomizr customizr * Up to
(excluding)
4.3.1
运行在以下环境
应用 presscustomizr hueman * Up to
(excluding)
3.6.2
运行在以下环境
应用 qtranslate_slug_project qtranslate_slug * Up to
(including)
1.1.18
运行在以下环境
应用 quantumcloud slider_hero * Up to
(excluding)
8.2.1
运行在以下环境
应用 radio_buttons_for_taxonomies_project radio_buttons_for_taxonomies * Up to
(excluding)
2.0.6
运行在以下环境
应用 rays_grid_project rays_grid * Up to
(including)
1.2.2
运行在以下环境
应用 rucy_project rucy * Up to
(including)
0.4.4
运行在以下环境
应用 slickremix feed_them_social * Up to
(excluding)
2.8.7
运行在以下环境
应用 sunshinephotocart sunshine_photo_cart * Up to
(excluding)
2.8.29
运行在以下环境
应用 themeisle rss_aggregator_by_feedzy * Up to
(excluding)
3.4.3
运行在以下环境
应用 thimpress wp_hotel_booking * Up to
(excluding)
1.10.2
运行在以下环境
应用 tychesoftwares abandoned_cart_lite_for_woocommerce * Up to
(excluding)
5.8.6
运行在以下环境
应用 villatheme abandoned_cart_recovery_for_woocommerce * Up to
(excluding)
1.0.4.1
运行在以下环境
应用 vuukle vuukle_comments,_reactions,_share_bar,_revenue * Up to
(excluding)
4.0
运行在以下环境
应用 webberzone better_search * Up to
(excluding)
2.5.3
运行在以下环境
应用 webberzone top_10 * Up to
(excluding)
2.9.5
运行在以下环境
应用 websitescanner remove_schema * Up to
(excluding)
1.6
运行在以下环境
应用 wedevs dokan * Up to
(excluding)
3.0.9
运行在以下环境
应用 wedevs dokan * From
(including)
3.1.0 		Up to
(excluding)
3.2.1
运行在以下环境
应用 wedevs wp_erp * Up to
(excluding)
1.6.4
运行在以下环境
应用 wedevs wp_erp * From
(including)
1.7.0 		Up to
(excluding)
1.7.5
运行在以下环境
应用 wedevs wp_project_manager * Up to
(excluding)
2.4.1
运行在以下环境
应用 wedevs wp_project_manager * From
(including)
2.4.2 		Up to
(excluding)
2.4.10
运行在以下环境
应用 wmpudev defender_security * Up to
(excluding)
2.4.6.1
运行在以下环境
应用 wp-mpdf_project wp-mpdf * Up to
(excluding)
3.5.2
运行在以下环境
应用 wpconcern coming_soon_&_maintenance_mode_page * Up to
(excluding)
1.58
运行在以下环境
应用 wpdeveloper notificationx * Up to
(excluding)
1.8.3
运行在以下环境
应用 wpeasypay wp_easypay * Up to
(excluding)
3.2.3
运行在以下环境
应用 wpexpertdeveloper wp_private_content_plus * Up to
(excluding)
3.2
运行在以下环境
应用 wpexperts post_smtp_mailer * Up to
(excluding)
2.0.21
运行在以下环境
应用 wpgogo custom_field_template * Up to
(excluding)
2.5.2
运行在以下环境
应用 wpopal opal_estate * Up to
(including)
1.6.11
运行在以下环境
应用 wpswings ultimate_gift_cards_for_woocommerce * Up to
(excluding)
2.1.2
CVSS3评分
8.8
  • 攻击路径
    网络
  • 攻击复杂度
    低
  • 权限要求
    无
  • 影响范围
    未更改
  • 用户交互
    需要
  • 可用性
    高
  • 保密性
    高
  • 完整性
    高
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-ID 漏洞类型
CWE-352 跨站请求伪造（CSRF）
阿里云安全产品覆盖情况