Partner Program
Platform
Comprehensive Threat Exposure Management Platform
Uni5 Xposure PlatformUni5 Xposure leverages exposure assessment and adversarial exposure validation to deliver a unified view of your cyber risks and all actionable pathways to resolve them.
IntegrationsSync with an abundant number of out-of-the-box integrations.
HiveForce LabsStrategic intelligence and operational expertise to ensure comprehensive security readiness at all levels.
Solutions
By Use Case
Total Attack Surface Management
Multi-Environment Security Scanners
Complete Exposure Assessment
Comprehensive Security Intelligence
Vulnerability & Threat Prioritization
Adversarial Exposure Validation
By Role
CISO
Vulnerability Management
Security Operations
DevOps
Industry
Telecommunications
Healthcare
Financial Services
Government & Public Sector
Retail & E-Commerce
Educational Institutions
Resources
Advisories & Digests
Threat Advisories
Threat Digests
Content Library
learn
Blog
Data Sheets
Whitepapers
Press Releases
connect
Webinars & Videos
Company
About Us
Careers
Our Leadership
Contact Us
Book a DemoStart Free Trial
Platform
Platform
Comprehensive Threat Exposure Management Platform
Uni5 Xposure PlatformUni5 Xposure leverages exposure assessment and adversarial exposure validation to deliver a unified view of your cyber risks and all actionable pathways to resolve them.
IntegrationsSync with an abundant number of out-of-the-box integrations.
HiveForce LabsStrategic intelligence and operational expertise to ensure comprehensive security readiness at all levels.
Solutions
Solutions
By Use Case
Total Attack Surface Management
Multi-Environment Security Scanners
Complete Exposure Assessment
Comprehensive Security Intelligence
Vulnerability & Threat Prioritization
Adversarial Exposure Validation
By Role
CISO
Vulnerability Management
Security Operations
DevOps
Industry
Industry
Telecommunications
Healthcare
Financial Services
Government & Public Sector
Retail & E-Commerce
Educational Institutions
Resources
Resources
Advisories & Digests
Threat Advisories
Threat Digests
Content Library
learn
Blog
Data Sheets
Whitepapers
Press Releases
connect
Webinars & Videos
Company
Company
About Us
Careers
Our Leadership
Contact Us
Book a DemoStart Free Trial

Critical vulnerabilities found in WordPress plugin affecting 400,000 sites.

Threat Level – Amber | Vulnerability Report
Download PDF

For a detailed advisory, download the pdf file here.

Around 400,000 sites were affected by several critical vulnerabilities(CVE-2021-34621, CVE-2021-34622, CVE-2021-34623, CVE-2021-34624) discovered in ProfilePress, a WordPress plugin. The vulnerabilities are easily exploitable which makes it possible for an adversary to gain admin access and upload arbitrary files to vulnerable sites without requiring any prior authentication. The frequent exploitation of the WordPress plugin makes it important for targeted websites admin to update the plugin to the latest available patched version 3.1.4.

Vulnerability Details

CVE IDAffected VersionsVulnerability Name
CVE-2021-346213.0 – 3.1.3Unauthenticated Privilege Escalation
CVE-2021-346223.0 – 3.1.3Authenticated Privilege Escalation
CVE-2021-346233.0 – 3.1.3Arbitrary File Upload in Image Uploader Component
CVE-2021-346243.0 – 3.1.3Arbitrary File Upload in Image Uploader Component

References

https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin/

https://vulners.com/wpvulndb/WPVDB-ID:E12448EC-84A0-46AA-B280-5D9A80EE1E41

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox