# CVE-2021-4374: WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update

- Exploited (CISA KEV): no
- Published: 2023-06-07
- CVSS: 9.1 CRITICAL (v3.1)
- EPSS: 16.4% (97th percentile)
- CWE: CWE-862

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-01-20 | 958 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2026-01-20 · new · rule 200013157
  > Added: signature 200013157 "WordPress Automatic Plugin Arbitrary Options Update" (Authentication/Authorization Attacks, risk High), systems: PHP, WordPress. References: CVE-2021-4374.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 2 requests blocked), template CVE-2021-4374, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 2 requests blocked), template CVE-2021-4374, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2021-4374 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2021-4374