CVE-2021-4425

CVE-2021-4425 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Defender Security plugin for WordPress, affecting versions up to and including 2.4.6. This flaw stems from inadequate nonce validation in the verify_otp_login_time() function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, potentially verifying a one-time login. The vulnerability carries a CVSS score of 4.3 (MEDIUM), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low integrity impact (e.g., verifying a login without authorization). There is no impact on confidentiality or availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.