Critical vulnerabilities found in WordPress plugin affecting 400,000 sites.

Threat Level – Amber | Vulnerability Report
Download PDF

For a detailed advisory, download the pdf file here.

Around 400,000 sites were affected by several critical vulnerabilities(CVE-2021-34621, CVE-2021-34622, CVE-2021-34623, CVE-2021-34624) discovered in ProfilePress, a WordPress plugin. The vulnerabilities are easily exploitable which makes it possible for an adversary to gain admin access and upload arbitrary files to vulnerable sites without requiring any prior authentication. The frequent exploitation of the WordPress plugin makes it important for targeted websites admin to update the plugin to the latest available patched version 3.1.4.

Vulnerability Details

CVE IDAffected VersionsVulnerability Name
CVE-2021-346213.0 – 3.1.3Unauthenticated Privilege Escalation
CVE-2021-346223.0 – 3.1.3Authenticated Privilege Escalation
CVE-2021-346233.0 – 3.1.3Arbitrary File Upload in Image Uploader Component
CVE-2021-346243.0 – 3.1.3Arbitrary File Upload in Image Uploader Component


What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox