PT-2021-4051 · WordPress · Wordpress

Ehti · Published 2021-03-30 · Updated 2024-03-06 · CVE-2021-29450

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.7.1

Description The issue is related to the exposure of information in WordPress, a content management system. It involves the exploitation of a block in the WordPress editor, which can expose password-protected posts and pages. This requires at least contributor privileges. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the requirement for contributor privileges to access sensitive data.

Recommendations For versions prior to 5.7.1, update to WordPress 5.7.1 or later to receive the fix. It is also recommended to keep auto-updates enabled to ensure the latest security patches are applied. As a temporary workaround, consider restricting access to the WordPress editor for users with contributor privileges until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-04579

BIT-WORDPRESS-2021-29450

BIT-WORDPRESS-MULTISITE-2021-29450

CVE-2021-29450

DLA-2630-1

DSA-4896-1

GHSA-PMMH-2F36-WVHQ

Affected Products

Wordpress

References · 20

• https://cve.org/CVERecord?id=CVE-2021-29450 · Security Note
• https://osv.dev/vulnerability/DSA-4896-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-29450 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2021-29450 · Vendor Advisory
• https://wordpress.org/news/category/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29450 · Security Note
• https://bdu.fstec.ru/vul/2021-04579 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29450 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2630-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29450 · Vendor Advisory
• https://debian.org/security/2021/dsa-4896 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29450 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2021-29450 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29450 · Vendor Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhq · Note