LiveActive security incident?Get immediate response
CVE Record

CVE-2021-4353: WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/Export

The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.

MediumCVSS 5.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-4353 lets unauthenticated visitors export settings from the WooCommerce Dynamic Pricing and Discounts WordPress plugin through version 2.4.1. This is mainly an information exposure issue, not a direct site takeover in the cited sources.

Executive priority

Prioritize remediation for public WooCommerce stores because pricing configuration may be exposed without login. Business urgency is moderate unless the exported settings contain sensitive commercial logic or operational details.

Technical view

The issue is missing authorization on the plugin's export() function. CVSS 3.1 is 5.3: network-accessible, low complexity, no privileges, no user interaction, with low confidentiality impact and no stated integrity or availability impact.

Likely exposure

Exposure is limited to WordPress/WooCommerce sites running RightPress WooCommerce Dynamic Pricing and Discounts versions up to and including 2.4.1.

Exploitation context

The source bundle does not cite active exploitation, and CISA KEV status is false. The vulnerability is unauthenticated and network reachable, so internet-facing stores should still treat affected versions as externally accessible.

Researcher notes

The record identifies missing authorization in export() and CWE-288. Available evidence supports confidentiality impact only. No exploit details, endpoint specifics, or confirmed exploitation are provided in the source bundle.

Mitigation direction

  • Inventory WordPress sites for the affected RightPress plugin and version.
  • Update beyond version 2.4.1 if a vendor-supported fixed release is available.
  • If no fixed release is available, disable or remove the plugin until guidance is confirmed.
  • Review vendor, Wordfence, and NinTechNet guidance before redeploying affected versions.

Validation and detection

  • Confirm the installed plugin version on every WooCommerce site.
  • Check whether affected sites expose plugin settings or pricing configuration externally.
  • Review web logs for unexpected unauthenticated settings export activity.
  • Verify the plugin is updated, disabled, or removed after remediation.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-288: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-4353 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.3Medium
CVSS 3.1 vector shape for CVE-2021-4353Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
RightPressWooCommerce Dynamic Pricing and Discounts0unaffected
Weakness

CWE details

CWE-288

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-288 · source CWE mapping

Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs