CVE-2021-29450 — Sensitive Information Exposure in Wordpress

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
4.3MEDIUMNVD
CNA6.5
EPSS
2.1%
top 15.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
WordpressDebian WordpressWordpress Wordpress-develop+1 more
Timeline
PublishedApr 15

Description

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/wordpress< wordpress 5.7.1+dfsg1-1 (bookworm)
▶NVDwordpress/wordpress4.7 — 5.7.1
▶Debianwordpress/wordpress< 5.7.1+dfsg1-1+3
▶CVEListV5wordpress/wordpress-develop>= 4.70,< 5.7.1

Also affects: Debian Linux 10.0, 9.0

🔴Vulnerability Details

2
OSV
CVE-2021-29450: Wordpress is an open source CMS↗2021-04-15
▶
CVEList
WordPress Authenticated disclosure of password-protected posts and pages↗2021-04-15
▶

📋Vendor Advisories

1
Debian
CVE-2021-29450: wordpress - Wordpress is an open source CMS. One of the blocks in the WordPress editor can b...↗2021
▶