CVE-2021-4428 - Vulnerability Details - OpenCVE

A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
What3words	Autosuggest

Configuration 1 [-]

cpe:2.3:a:what3words:autosuggest:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac
https://github.com/what3words/wordpress-autosuggest-plugin/pull/20
https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1
https://vuldb.com/?ctiid.234247
https://vuldb.com/?id.234247

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.67121}`	epss `{'score': 0.67578}`

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2023-07-18T17:00:04.337Z

Updated: 2024-08-03T17:23:10.776Z

Reserved: 2023-07-16T14:43:55.166Z

Link: CVE-2021-4428

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-07-18T17:15:11.140

Modified: 2024-11-21T06:37:42.410

Link: CVE-2021-4428

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-4428", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2023-07-16T14:43:55.166Z", "datePublished": "2023-07-18T17:00:04.337Z", "dateUpdated": "2024-08-03T17:23:10.776Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2023-10-20T13:57:49.925Z"}, "title": "what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "CWE-200 Information Disclosure"}]}], "affected": [{"vendor": "what3words", "product": "Autosuggest Plugin", "versions": [{"version": "4.0", "status": "affected"}], "modules": ["Setting Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247."}, {"lang": "de", "value": "In what3words Autosuggest Plugin bis 4.0.0 f\u00fcr WordPress wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Betroffen ist die Funktion enqueue_scripts der Datei w3w-autosuggest/public/class-w3w-autosuggest-public.php der Komponente Setting Handler. Mit der Manipulation mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 4.0.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als dd59cbac5f86057d6a73b87007c08b8bfa0c32ac bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N"}}], "timeline": [{"time": "2021-11-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2021-11-17T00:00:00.000Z", "lang": "en", "value": "Countermeasure disclosed"}, {"time": "2023-07-16T00:00:00.000Z", "lang": "en", "value": "CVE reserved"}, {"time": "2023-07-16T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2023-08-06T12:21:54.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB GitHub Commit Analyzer", "type": "tool"}], "references": [{"url": "https://vuldb.com/?id.234247", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.234247", "tags": ["signature", "permissions-required"]}, {"url": "https://github.com/what3words/wordpress-autosuggest-plugin/pull/20", "tags": ["issue-tracking"]}, {"url": "https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac", "tags": ["patch"]}, {"url": "https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1", "tags": ["patch"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:23:10.776Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.234247", "tags": ["vdb-entry", "technical-description", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.234247", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://github.com/what3words/wordpress-autosuggest-plugin/pull/20", "tags": ["issue-tracking", "x_transferred"]}, {"url": "https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac", "tags": ["patch", "x_transferred"]}, {"url": "https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1", "tags": ["patch", "x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:what3words:autosuggest:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "C9E99C24-45B5-40D0-AC7B-5DA7A99A5D31", "versionEndExcluding": "4.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247."}], "id": "CVE-2021-4428", "lastModified": "2024-11-21T06:37:42.410", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-07-18T17:15:11.140", "references": [{"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/what3words/wordpress-autosuggest-plugin/pull/20"}, {"source": "[email protected]", "tags": ["Release Notes"], "url": "https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1"}, {"source": "[email protected]", "tags": ["Permissions Required"], "url": "https://vuldb.com/?ctiid.234247"}, {"source": "[email protected]", "tags": ["Permissions Required"], "url": "https://vuldb.com/?id.234247"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/what3words/wordpress-autosuggest-plugin/pull/20"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://vuldb.com/?ctiid.234247"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://vuldb.com/?id.234247"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "[email protected]", "type": "Secondary"}]}