Vulnerability · Published Jun 7, 2023 · Assigned by Wordfence
CVE-2021-4371WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change
Medium 4.3
In plain English
A medium-severity missing authorization in WP Quick FrontEnd Editor – WordPress Plugin from labibahmed42. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security nonce and a capabilities check. This makes it possible for low-authenticated attackers to change plugin settings even when they do not have the capabilities to do so.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| labibahmed42 | WP Quick FrontEnd Editor – WordPress Plugin | 0 – through 5.5 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N