PT-2021-4505 · WordPress · Wordpress

Ehti · Published 2021-09-09 · Updated 2024-03-06 · CVE-2021-39200

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 5.8.1

Description The issue is related to the wp die() function in WordPress, which can leak output data under certain conditions, including sensitive information like nonces. This leaked data can be used to perform actions on behalf of the user. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 5.8.1, update to WordPress 5.8.1 or later to receive the fix. It is strongly recommended to keep auto-updates enabled to ensure the receipt of the fix. As a temporary workaround, consider restricting access to the wp die() function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-05143

BIT-WORDPRESS-2021-39200

BIT-WORDPRESS-MULTISITE-2021-39200

CVE-2021-39200

DSA-4985-1

GHSA-M9HC-7V5Q-X8Q5

Affected Products

Wordpress

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2021-39200 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-2021-39200 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4985-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-39200 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-39200 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-39200 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-39200 · Security Note
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2021-39200 · Vendor Advisory
• https://debian.org/security/2021/dsa-4985 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05143 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-39200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39200 · Vendor Advisory
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m9hc-7v5q-x8q5 · Note
• https://t.me/cibsecurity/28652 · Telegram Post
• https://hackerone.com/reports/1142140 · Note