VULNERABILITY INTELLIGENCE

CVE-2021-4451

CVSS score6.6 MEDIUM
EPSS probability0.64%
CISA KEVNot currently listed
Published2024-10-16
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).

Weakness classification

  • CWE-502: Deserialization of Untrusted Data

Primary references