CVE-2021-34621
Access Control in Properfraction Profilepress 3.0.0 – 3.1.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2021-34621 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Properfraction Profilepress. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-21271
Vulnerability Data
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 8 OS baselines
V6.2.3V6.4.4V10.4.16V12.1.3
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Certification assesses that critical functions have required authentication controls in place.
Baseline tailoring enforces organization-specific privilege-management decisions rather than accepting generic high-water-mark settings.
Documented procedures for role definition, privilege assignment, and removal provide the management framework that prevents improper privilege management.
By determining which components are critical, the analysis drives proper privilege assignment and management for those components, limiting attacker escalation paths.
Developer training on implemented privilege management controls prevents improper assignment or escalation through correct configuration and operation.
Least-privilege and separation-of-duties principles prevent improper privilege management.
Usage restrictions and implementation guidelines limit how privileges may be exercised with the specified components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
PR.AA-05 enforces least privilege/SoD and periodic reviews that directly remove most privilege-assignment defects, yet CWE-269 also covers escalation paths and role design outside a single access-management control.
PR.AA-01 supplies credential/identity lifecycle support that can reduce some privilege-assignment errors but does not itself assign, modify, or check privileges, leaving most of CWE-269's risk unaddressed.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Config baselines and default reviews can enforce some privilege-related settings (one facet) but do not address code-level assignment/tracking logic that defines CWE-269.
PR.PS-05 can partially limit exploitability of some privilege issues via execution restrictions, but does not address the core design/implementation flaws of CWE-269 at all.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.
Requiring owner approval, segregation of duties, and periodic reviews prevents the assignment of excessive or unnecessary privileges to users or processes.
Enforcing minimum-necessary privileges, temporary grants, and separation of administrative versus normal identities prevents the over-assignment of rights that CWE-269 describes.
Dynamic techniques that grant the minimum necessary rights for a given time window and revoke them afterward reduce the window in which excessive or unnecessary privileges can be exploited.
Explicit restrictions on privileged access and segregation of duties limit the scope of privileges that can be assigned, reducing the chance that excessive or unnecessary privileges are granted to entities.
Defining and communicating authorization levels for each role limits the assignment of excessive or unnecessary privileges.