CVE-2021-38342

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
8.1HIGH
EPSS
0.1%
top 73.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Kyle Phillips Nested PagesKylephillips Nested Pages
Timeline
PublishedAug 30
Latest updateMay 24

Description

The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5kyle_phillips/nested_pages3.1.15 — 3.1.15

🔴Vulnerability Details

2
GHSA
GHSA-rq28-x6fq-j954: The Nested Pages WordPress plugin <= 3↗2022-05-24
▶
CVEList
Nested Pages <= 3.1.15 Cross-Site Request Forgery to Arbitrary Post Deletion and Modification↗2021-08-30
▶
CVE-2021-38342 (HIGH CVSS 8.1) | The Nested Pages WordPress plugin < | cvebase.io