CVE-2021-29450

MEDIUM severity · CVSS 6.5 · Information disclosure

6.5CVSS MEDIUM

Summary

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)2%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

WordPress

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://wordpress.org/news/category/security/Advisory
https://wordpress.org/news/category/security/Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhqAdvisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00017.htmlAdvisory
https://www.debian.org/security/2021/dsa-4896Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhqAdvisory
https://lists.debian.org/debian-lts-announce/2021/04/msg00017.htmlAdvisory
https://www.debian.org/security/2021/dsa-4896Advisory