CVE-2021-4373: ajay better search – relevant search results for wordpress Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2021-4373 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in ajay better search – relevant search results for wordpress. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.5.3.
Timeline
- 07-06-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NDiffers
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.46% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected systems
3 vendors · 3 products