CVE-2021-38312: The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered…

PriorityP339medium6.5CVSS 3.1

AVNACLPRLUINSUCNIHAN

EPSS

1.34%

67.8th percentile

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
redux.io	gutenberg_template_library_redux_framework	4.2.11 – 4.2.11	—
redux	gutenberg_template_library_redux_framework	<= 4.2.11	—

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.