{"id":"CVE-2021-4428","published":"2023-07-18T17:00:04Z","modified":"2024-08-03T17:23:10Z","title":"what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure","vendor":"what3words","product":"Autosuggest Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"what3words","product":"Autosuggest Plugin","versions":["4.0"]}],"description":{"text":"A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.","provenance":"source","from":"CVE.org"},"summary":{"text":"The what3words Autosuggest Plugin (up to 4.0.0 for WordPress) contains a flaw in the enqueue_scripts function of the Setting Handler component, in the file w3w-autosuggest/public/class-w3w-autosuggest-public.php, that exposes sensitive information to unauthorized actors. Exploitation can be launched remotely over the network with low attack complexity, but it requires high privileges, and no user interaction is needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:01Z"},"cvss":{"score":2.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.15808,"percentile":0.96868,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"CAPE Sandbox","url":"https://otx.alienvault.com/pulse/6a64183e8a5f8dc46c7658ec","created":"2026-07-25"},{"name":"Credit Mohdrennis Clone | 2022-10-03 Threat Intel Report","url":"https://otx.alienvault.com/pulse/6a6413cbf9ffe926da5da7f3","created":"2026-07-25"},{"name":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://otx.alienvault.com/pulse/633c0f200aa7a48f62fb6c4b","created":"2022-10-04"},{"name":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://otx.alienvault.com/pulse/633bc4ffe50b434caf1d7419","created":"2022-10-04"},{"name":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://otx.alienvault.com/pulse/633bc352b7e7eb15b49bdb42","created":"2022-10-04"},{"name":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://otx.alienvault.com/pulse/633b4e3178ebc39cc81850eb","created":"2022-10-03"},{"name":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://otx.alienvault.com/pulse/633b40b7ba504b51f2688631","created":"2022-10-03"},{"name":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://otx.alienvault.com/pulse/633adacc74c9aca5bb26c159","created":"2022-10-03"}],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://vuldb.com/?id.234247","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.234247","tags":["signature","permissions-required"]},{"url":"https://github.com/what3words/wordpress-autosuggest-plugin/pull/20","tags":["issue-tracking"]},{"url":"https://github.com/what3words/wordpress-autosuggest-plugin/commit/dd59cbac5f86057d6a73b87007c08b8bfa0c32ac","tags":["patch"]},{"url":"https://github.com/what3words/wordpress-autosuggest-plugin/releases/tag/v4.0.1","tags":["patch"]}],"techniques":[],"reports":[{"id":"SRC-93751f8c8ac64a7035ca","title":"Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","publisher":"sygnia.co","url":"https://www.sygnia.co/threat-reports-and-advisories/revealing-emperor-dragonfly-a-chinese-ransomware-group/","date":"2022-10-03","mentions":[{"quote":"In January 2022, a VMware Horizon server was compromised by threat actors leveraging the Log4Shell vulnerability (CVE-2021-4428).","start":2579,"end":2708}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-34255","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-34255","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-12-21","earliestUrl":"https://github.com/CERT-hr/Log4Shell","repos":[{"name":"CERT-hr/Log4Shell","url":"https://github.com/CERT-hr/Log4Shell","stars":0,"created":"2021-12-21"}]},"first":{"date":"2021-12-21","source":"PoC-in-GitHub","url":"https://github.com/CERT-hr/Log4Shell"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-12-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/CERT-hr/Log4Shell","provenance":"source"},{"date":"2022-10-03","kind":"report","label":"Named in sygnia.co: Revealing Emperor Dragonfly: Night Sky and Cheerscrypt - A Single Ransomware Group","url":"https://www.sygnia.co/threat-reports-and-advisories/revealing-emperor-dragonfly-a-chinese-ransomware-group/","provenance":"machine"},{"date":"2023-07-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-4428","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":32.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.37,"detail":"percentile 0.9687"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":1.89,"detail":"base score 2.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}