wordpress wordpress CVE-2021-29450 in WordPress and Debian Products
Published on April 15, 2021

WordPress Authenticated disclosure of password-protected posts and pages

product logo product logo
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2021-29450 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2021-29450 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2021-29450

stack.watch emails you whenever new vulnerabilities are published in WordPress or Debian Linux. Just hit a watch button to start following.

WordPress
 
Debian Linux
 

Affected Versions

wordpress-develop Version >= 4.70,< 5.7.1 is affected by CVE-2021-29450

Exploit Probability

EPSS
2.08%
Percentile
83.73%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.