CVE-2021-39203

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

0.94% chance of exploitation in the next 30 days, 59th percentile

Nuclei

low

Published

2021-09-09

Updated

2024-08-04

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2021/CVE-2021-39203-wordpress-6…

References

• CVE Record
• NVD entry

Related

• CVE-2021-39202
• CVE-2021-39211
• CVE-2021-39201
• CVE-2021-39226
• CVE-2021-39200
• CVE-2021-39243