CVE-2021-4400

CVE-2021-4400 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Better Search plugin for WordPress, affecting versions up to and including 2.5.2. This flaw stems from insufficient nonce validation in the settings import and export functions. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized modification or disclosure of plugin settings. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to integrity and no impact to confidentiality or availability. While the EPSS score is very low, suggesting a low probability of exploitation, the FAUCET Risk Score is 9/100, indicating a slightly elevated risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with a large percentage of reported vulnerabilities.