CVE-2021-29450CWE-200

WordPress Authenticated disclosure of password-protected posts and pages

Medium · published April 15, 2021

CVSS v3.1
6.5
EPSS
2%
Percentile
81.5
In the wild
Unconfirmed
What it is

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02093 · 81.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-04-15T21:20Z
EPSS history
Timeline
  • 15 APR 21:20Z
    WordPress Authenticated disclosure of password-protected posts and pages
    cvelistv5