CVE-2021-4397

CVE-2021-4397 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Staff Directory Plugin for WordPress, affecting versions up to and including 3.6. This flaw stems from inadequate nonce validation within the saveCustomFields() function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized modification of custom fields. The vulnerability is rated Medium severity (CVSS 4.3), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low integrity impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.