CVE-2021-20779: 
WordPress vulnerability analysis and mitigation

Cross-site request forgery (CSRF) vulnerability was discovered in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8. The vulnerability was identified and assigned CVE-2021-20779, allowing remote attackers to potentially hijack the authentication of administrators through unspecified vectors (JVN Advisory, NVD).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) with a CVSS v3.1 base score of 8.8 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The plugin lacked proper CSRF protection when saving its options, which could allow attackers to make changes to the plugin settings when a logged-in administrator visits a malicious page. Due to insufficient sanitization in some options, this could also lead to Stored XSS (WPScan).

If successfully exploited, an attacker could potentially hijack administrator authentication and perform unauthorized actions on behalf of the administrator. The vulnerability could allow attackers to modify plugin settings and potentially inject malicious content through stored XSS (JVN Advisory, WPScan).

The vulnerability requires user interaction, specifically requiring an administrator to be logged in and visit a malicious page while authenticated. The attack complexity is considered low, requiring no privileges, but does need user interaction to succeed (NVD).

Users are advised to update WordPress Email Template Designer - WP HTML Mail to version 3.0.8 or later, which contains the fix for this vulnerability. The update addresses both the CSRF vulnerability and implements proper sanitization measures (JVN Advisory).