CVE-2021-4413: 
WordPress vulnerability analysis and mitigation

CVE-2021-4413 affects the Process Steps Template Designer WordPress plugin versions up to and including 1.2.1. The vulnerability was discovered and disclosed by Jerome Bruandet of NinTechNet, and was published on July 12, 2023. The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation in the save() function (NVD).

The vulnerability stems from improper CSRF protection in the save() function of the Process Steps Template Designer plugin. The CVSS v3.1 base score is 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The technical issue involves missing or incorrect nonce validation, which fails to properly verify the authenticity of requests (Wordfence).

The vulnerability allows unauthenticated attackers to save field icons through forged requests if they can trick a site administrator into performing specific actions, such as clicking on a malicious link. This could potentially lead to unauthorized modifications of the plugin's settings (NVD).

The vulnerability has been patched in version 1.2.2 of the Process Steps Template Designer plugin. Site administrators are advised to update to the latest version of the plugin to mitigate this security risk (WordPress Plugin).