PT-2021-4476 · WordPress · Wordpress

Ehti · Published 2021-09-09 · Updated 2024-01-31 · CVE-2021-39203

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions 5.8 beta

Description The issue is related to authentication errors in the WordPress content management system. It allows a remote attacker to bypass existing restrictions. Authenticated users without permission to view private post types or data can bypass restrictions in the block editor under certain conditions.

Recommendations For WordPress version 5.8 beta, update to the final 5.8 release to resolve the issue. As a temporary workaround, consider restricting access to the block editor for authenticated users without proper permissions until the update is applied.

Fix

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-863

Related Identifiers

BDU:2021-05109

BIT-WORDPRESS-2021-39203

BIT-WORDPRESS-MULTISITE-2021-39203

CVE-2021-39203

GHSA-QXVW-QXM9-QVG6

Affected Products

Wordpress

References · 11

• https://osv.dev/vulnerability/BIT-wordpress-multisite-2021-39203 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39203 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39203 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05109 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39203 · Security Note
• https://ubuntu.com/security/CVE-2021-39203 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2021-39203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39203 · Vendor Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6 · Note
• https://t.me/cibsecurity/28649 · Telegram Post
• https://hackerone.com/reports/1225282 · Note