CVE-2021-29450 WordPress Authenticated disclosure of password-protected posts and pages

2021-04-1521:20:10

CWE-200

GitHub_M

www.cve.org

wordpress

cms

authenticated disclosure

password-protected posts

pages

exploit

contributor privileges

patch

auto-updates

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.007

Percentile

79.6%

JSON

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It’s strongly recommended that you keep auto-updates enabled to receive the fix.

CNA Affected

[
  {
    "product": "wordpress-develop",
    "vendor": "WordPress",
    "versions": [
      {
        "status": "affected",
        "version": ">= 4.70,< 5.7.1"
      }
    ]
  }
]