CVE-2021-4405

CVE-2021-4405 describes a Cross-Site Request Forgery (CSRF) vulnerability in the ElasticPress plugin for WordPress, affecting versions up to and including 3.5.3. This flaw stems from inadequate nonce validation within the epio_send_autosuggest_allowed() function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to the unauthorized sending of autosuggest parameters to elasticpress.io. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in a low integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). While the FAUCET Risk Score is 9/100, its EPSS score is very low at 0.00128, suggesting a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered no community discussion or media coverage, which is typical for the vast majority of CVEs.