CVE-2021-4428

what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure

2.7 LowPublic exploit

A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

15.8%Up 15.8 points since Jul 19, 2023

What each source reports

CVE List Score used 2.7

what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure

Record: CVE-2021-4428
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0: 2.7 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2021-34255 2.7

Record: EUVD-2021-34255
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gf9p-c4mf-w382 2.7

A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and...

Record: GHSA-gf9p-c4mf-w382
CVSS 3.0: 2.7 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 2.7

Record: CVE-2021-4428
CVSS 3.1: 2.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 3.3 LowAV:N/AC:L/Au:M/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 7.5

Record: CVE-2021-4428
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	CERT-hr/Log4Shell	2021-12-21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-4428 is a low vulnerability (CVSS 2.7) in What3words Autosuggest, published July 18, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 15.8%, the 96th percentile. No source names a fixed version.