Description

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Remediation

References

CVE-2021-29450

Related Vulnerabilities

WordPress Plugin WP-reCAPTCHA Cross-Site Scripting (3.1.3)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2359)

MyBB Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-3965)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-22293)

Dotclear Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-3232)

Severity

Medium

Classification

CVE-2021-29450 CWE-200 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities