# CVE-2021-4374: WordPress Automatic Plugin - Missing Authorization

> Live exploitation tracking for CVE-2021-4374 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-4374

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.1
- **Public exploit available:** Yes
- **Affected products:** ValvePress WordPress Automatic Plugin
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** wordpress

## Description

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.

## CrowdSec analysis

[CVE-2021-4374](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-4374) is a high-severity vulnerability in the WordPress Automatic Plugin by ValvePress, affecting versions up to 3.53.2. Due to missing authorization and validation in the process_form.php file, unauthenticated attackers can arbitrarily update site options, potentially leading to full site compromise. This flaw could be exploited to alter critical settings, disrupt site functionality, or enable further attacks against WordPress sites.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-4374 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2021-4374. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by sending unauthenticated POST requests to `/wp-content/plugins/wp-automatic/process_form.php`, attempting to change arbitrary WordPress options and settings. This endpoint is targeted to escalate privileges or modify site configurations without authentication.

## Timeline

- 2023-06-07: CVE Published. CVE-2021-4374 is published to NVD.
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2021-4374 exploitation attempts against the CrowdSec Network.
- 2025-11-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-4374 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4374.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-4374) follows observed exploitation activity for CVE-2021-4374. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.