Now officially on WordPress.org

CVE Database / CVE-2021-4366

CVE · Medium

CVE-2021-4366 — PWA for WP – Progressive Web Apps Made Simple [pwa-for-wp] < 1.7.33

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2021-4366 PWA for WP – Progressive Web Apps Made Simple [pwa-for-wp] < 1.7.33 Missing Authorization Medium 4.3 < 1.7.33 1.7.33 2021-07-01 —

CVE-2021-4366

The PWA for WP & AMP plugin contains an authorization bypass vulnerability in versions up to 1.7.32 where the pwaforwp_update_features_options function lacks proper capability verification. This flaw allows any authenticated user to modify plugin settings that should be restricted to administrators or higher-privileged roles. The vulnerability was patched in version 1.7.33.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings