CVE-2021-39327CWE-200

BulletProof Security <= 5.1 Sensitive Information Disclosure

Medium · published September 17, 2021

Patch now

High probability of exploitation

CVSS calls it medium at 5.3. It sits in the 99.4th percentile for exploit probability.

CVSS v3.1
5.3
EPSS
72%
Percentile
99.4
In the wild
Unconfirmed
What it is

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.71688 · 99.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-09-17T10:26Z
EPSS history
Timeline
  • 17 SEP 10:26Z
    BulletProof Security <= 5.1 Sensitive Information Disclosure
    cvelistv5