Back to Database
Status published
Unknown
CVE-2021-34620
CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation
Vulnerability Description
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34620
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Ramuel Gall, Wordfence
Affected Vendor
WP Manage Ninja
View all reports →Affected Software
WP Fluent Forms
Vulnerable Versions:
3.6.67
Timeline
Official Publish:
July 7th, 2021
Last Modified:
October 15th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
MITRE ATT&CK TTPs
T1566.002
Spearphishing Link
Initial Access
T1204.001
Malicious Link
Execution
T1098
Account Manipulation
Persistence
T1565.001
Stored Data Manipulation
Impact
T1189
Drive-by Compromise
Initial Access
T1059.007
JavaScript
Execution
T1539
Steal Web Session Cookie
Collection
T1213
Data from Information Repositories
Collection
T1567
Exfiltration Over Web Service
Exfiltration
T1491.001
Defacement
Impact