Security readout for executives and security teams
Plain-English summary
A WordPress rating plugin allowed bad rating input to break affected post or page views. For businesses, the impact is availability: public content using the plugin could become unusable until the issue is corrected.
Executive priority
Treat as a targeted availability risk for affected WordPress content, not a confirmed breach indicator. Prioritize sites where rated pages support revenue, support, or public reputation.
Technical view
Rating by BestWebSoft before 1.6 did not validate submitted rating values. Sources say a long integer rating could trigger denial of service on the affected post or page. CVSS is not provided, and the bundle lists CWE-191.
Likely exposure
Exposure is likely limited to WordPress sites running Rating by BestWebSoft before version 1.6, especially posts or pages where rating submission is enabled.
Exploitation context
The source bundle does not cite active exploitation, and CISA KEV status is false. Abuse would require submitting an invalid oversized rating value to content using the plugin.
Researcher notes
Evidence is narrow and lacks CVSS detail. Validate the plugin version, rating submission path, and server-side bounds checking. Do not assume broader WordPress compromise from this CVE alone.
Mitigation direction
- Upgrade Rating by BestWebSoft to version 1.6 or later.
- If upgrade is unavailable, disable or remove the plugin temporarily.
- Check vendor or plugin repository guidance for current fixed versions.
- Restrict rating submission where business impact is high until remediated.
Validation and detection
- Inventory WordPress sites for Rating by BestWebSoft installations.
- Confirm installed plugin versions are not earlier than 1.6.
- Review affected posts or pages for availability errors.
- Check logs for abnormal rating submissions or repeated page failures.
- After remediation, confirm rating submissions and page rendering still work.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-191: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-25121 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/efb1ddef-2123-416c-a932-856d41ed836dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Underflow (Wrap or Wraparound)
Integer Underflow (Wrap or Wraparound) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.