PT-2021-22031 · Unknown · The Gutenberg Template Library & Redux Framework

Ramuel Gall · Published 2021-09-02 · Updated 2026-05-24 · CVE-2021-38314

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gutenberg Template Library & Redux Framework plugin versions prior to 4.2.11

Description The Gutenberg Template Library & Redux Framework plugin registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These actions were unique to a given site but predictable, as they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of the site’s AUTH KEY concatenated with the SECURE AUTH KEY.

Recommendations Update the Gutenberg Template Library & Redux Framework plugin to version 4.2.11 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-760

CWE-916

Related Identifiers

CVE-2021-38314

Affected Products

The Gutenberg Template Library & Redux Framework

References · 15

• 🔥 https://github.com/onsecuredev/CVE-2021-38314 · Exploit
• 🔥 https://github.com/byteofjoshua/CVE-2021-38314 · Exploit
• 🔥 https://github.com/phrantom/cve-2021-38314 · Exploit
• 🔥 https://github.com/oxctdev/CVE-2021-38314 · Exploit
• 🔥 https://github.com/thomsdev/CVE-2021-38314 · Exploit
• 🔥 https://github.com/byteofandri/CVE-2021-38314 · Exploit
• 🔥 https://github.com/orangmuda/CVE-2021-38314 · Exploit
• 🔥 https://github.com/rakhanobe/CVE-2021-38314 · Exploit
• 🔥 https://github.com/akhilkoradiya/CVE-2021-38314 · Exploit
• 🔥 https://wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-38314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38314 · Security Note
• https://twitter.com/sjourdan/status/2058535320329589068 · Twitter Post
• https://twitter.com/bountywriteups/status/1962912377952756184 · Twitter Post
• https://t.me/cybersecuritytechnologies/4905 · Telegram Post