CVE-2021-4425: wordpress defender-security Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2021-4425 is a medium (CVSS 4.3) Cross-Site Request Forgery (CSRF) vulnerability in wordpress defender-security. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.6% of scored vulnerabilities. 8 public exploits are recorded. Fixed in 2.4.6.1.
Timeline
- 12-07-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
8 foundExploit Reference (wordfence.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Show all 8 exploits
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Exploit Reference (blog.nintechnet.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Wpmudev2 products
Wordpress1 product
- defender-security≤ 2.4.6 (fixed in 2.4.6.1)
2 vendors · 3 products
References
10 links- www.wordfence.com/threat-intel/vulnerabilities/id/e772fbbe-33d5-46fa-a041-ab07d3f9318f?source=cveExploitPatchThird Party Advisory
- blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ExploitThird Party Advisory
- blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ExploitThird Party Advisory