WordPress Automatic Plugin - Missing Authorization (CVE-2021-4374)

CVE-2021-4374 is a high-severity vulnerability in the WordPress Automatic Plugin by ValvePress, affecting versions up to 3.53.2. Due to missing authorization and validation in the process_form.php file, unauthenticated attackers can arbitrarily update site options, potentially leading to full site compromise. This flaw could be exploited to alter critical settings, disrupt site functionality, or enable further attacks against WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-4374 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2021-4374. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by sending unauthenticated POST requests to /wp-content/plugins/wp-automatic/process_form.php, attempting to change arbitrary WordPress options and settings. This endpoint is targeted to escalate privileges or modify site configurations without authentication.