WordPress Plugin Vulnerabilities

Opal Estate <= 1.6.11 - Cross-Site Request Forgery

Description

The plugin does not protect the opalestate_set_feature_property and opalestate_remove_feature_property functions against CSRF attacks, allowing an unauthenticated attacker to set and remove featured properties by tricking a logged in administrator to submit a crafted request.

Affects Plugins

Plugin icon
opal-estate
No known fix

References

CVE
CVE-2021-4387
URL
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
3d15db7b-d920-4583-aee3-2a1260ee0885

Timeline

Publicly Published
2021-08-16 (about 4 years ago)
Added
2023-07-04 (about 2 years ago)
Last Updated
2023-07-04 (about 2 years ago)

Other

Published
Title
Published
2025-08-23
Title
Ultimate twitter profile widget <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2014-08-01
Title
Wordpress 3.3.1 - Multiple Cross-Site Request Forgery (CSRF)
Published
2025-06-27
Title
WP Optimizer <= 2.3.6 - Cross-Site Request Forgery
Published
2023-11-08
Title
Product Catalog Simple < 1.7.6 - Cross-Site Request Forgery via ic_system_status
Published
2025-03-28
Title
Terms of Use <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting