wordpress wordpress CVE-2021-39200 in WordPress and Debian Products
Published on September 9, 2021

Information Disclosure in wp_die() via JSONP in wordpress

product logo product logo
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2021-39200 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2021-39200 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2021-39200

stack.watch emails you whenever new vulnerabilities are published in WordPress or Debian Linux. Just hit a watch button to start following.

WordPress
 
Debian Linux
 

Affected Versions

wordpress-develop Version >= 5.2.0, < 5.8.1 is affected by CVE-2021-39200

Exploit Probability

EPSS
1.67%
Percentile
81.93%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.