CVE-2021-4407

The Custom Banners plugin through version 3.2.2 contains a Cross-Site Request Forgery vulnerability where the saveCustomFields() function lacks proper nonce validation. An unauthenticated attacker could exploit this flaw by crafting a malicious request that, if clicked by an administrator, would allow the attacker to save custom fields without authorization. The vulnerability was patched in version 3.3.

Based on public CVE data (MITRE/NVD).