High severity8.1NVD Advisory· Published Aug 30, 2021· Updated Jun 17, 2026

CVE-2021-38342

Description

The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the npBulkActions and npBulkEdit admin_post actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.

Affected products

WordPress/Nested Pagesllm-fuzzy
Range: <=3.1.15
Kyle Phillips/Nested Pagesv5
Range: 3.1.15

Patches

Vulnerability mechanics

References

www.wordfence.com/vulnerability-advisories/nvdThird Party Advisory
www.wordfence.com/blog/2021/08/nested-pages-pat%E2%80%A6on-vulnerability/nvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000