6.5

CVE-2021-39203

Private data disclosure/privilege escalation through the block editor in Wordpress

WordPress Core 5.8 beta - Block Editor Authorization Bypass

WordPress 5.8 beta: Private data disclosure/privilege escalation through the block editor

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
Mögliche Gegenmaßnahme
WordPress: Update to version 5.8, or a newer patched version
WordPress Core: Install latest version
WordPress Core: Install latest version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wordpress ≫ Wordpress Version 5.8 Update beta1
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version 5.8 beta 1
System
≫
Produkt WordPress Core
Version >= 5.8 beta 1, < 5.8
System
≫
Produkt WordPress Core
Version >= 5.8 beta 1, < 5.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.94% 0.566
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
security-advisories@github.com 6.8 1.6 5.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6
Third Party Advisory
https://hackerone.com/reports/1225282
Permissions Required
https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed9a567-fde4-4b6f-81c1-423c5cbba0a9
Third Party Advisory
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6
Third Party Advisory