Security readout for executives and security teams
Plain-English summary
CVE-2021-4388 affects the WordPress Opal Estate plugin through version 1.6.11. The flaw can let an attacker change which property listings are marked as featured. This is primarily an integrity issue: it can alter business presentation and listing prioritization, but the sources do not indicate data theft, service outage, or active exploitation.
Executive priority
Treat this as a moderate priority for affected real estate sites. It is unlikely to be a crisis based on the supplied evidence, but unauthorized listing promotion can affect revenue, customer trust, and site integrity. Patch or disable affected installations during the next normal security maintenance window, sooner for high-traffic sites.
Technical view
The issue is missing authorization in Opal Estate functions opalestate_set_feature_property() and opalestate_remove_feature_property(). Sources describe unauthorized featured-property set and removal actions. The CVE text says unauthenticated attackers, while the CVSS vector lists PR:L; treat privilege requirements as source-inconsistent until validated against vendor code and advisory details.
Likely exposure
Exposure is limited to WordPress sites running the Opal Estate plugin up to and including 1.6.11, especially real estate sites using featured listings. Sites without this plugin, or with a version confirmed outside the affected range, are not indicated as exposed by the provided sources.
Exploitation context
The source bundle does not cite active exploitation, and KEV status is false. The described impact is unauthorized manipulation of featured property status over the network with low complexity. Public references include vulnerability intelligence, a related WordPress plugin CSRF write-up, and plugin source code location.
Researcher notes
Key uncertainty: the CVE description says unauthenticated exploitation, but the CVSS vector requires low privileges. Verify behavior directly against the affected plugin version and current vendor code before final severity decisions. Do not assume broader data access or code execution from the provided evidence.
Mitigation direction
- Inventory WordPress sites for the Opal Estate plugin and installed version.
- Update Opal Estate to a vendor-supported release not listed as affected.
- If no safe update is available, disable the plugin until vendor guidance is confirmed.
- Review featured-listing changes for unauthorized or unexpected modifications.
- Restrict WordPress administrative exposure where operationally feasible.
Validation and detection
- Confirm whether Opal Estate is installed on each WordPress property site.
- Verify installed plugin versions against the affected range through 1.6.11.
- Review recent featured property changes for unexpected additions or removals.
- Check vendor or Wordfence guidance for the confirmed fixed release.
- Validate that feature-property actions require proper authorization checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-4388 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=cveCVE reference
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/CVE reference
- https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.