Wpopal Opal Estate vulnerabilities

2 vulnerabilities

Known vulnerabilities in Wpopal Opal Estate, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2021-4388wordpressopal-estate+1
EPSS score
0.73%
The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties.8.8CVE-2021-4387wordpressopal-estate+1
EPSS score
0.58%
The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect nonce validation on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.