CVE-2021-29450
WordPress Authenticated disclosure of password-protected posts and pages
- State
- Published
- Severity
- 6.5 Medium
- Published
- Apr 15, 2021
- Updated
- Aug 3, 2024
- Reserved
- Mar 30, 2021
Description
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-200 {"CWE-200":"Exposure of Sensitive Information to an Unauthorized Actor"}
Affected Products
| Product | Versions |
|---|---|
wordpress-developWordPress |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.