CVE-2021-39203CWE-200

Private data disclosure/privilege escalation through the block editor in Wordpress

Medium · published September 9, 2021

CVSS v3.1
6.8
EPSS
1%
Percentile
60.6
In the wild
Unconfirmed
What it is

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00941 · 60.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-09-09T22:00Z
EPSS history
Timeline
  • 09 SEP 22:00Z
    Private data disclosure/privilege escalation through the block editor in Wordpress
    cvelistv5