CVE-2021-39327

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

71.69% chance of exploitation in the next 30 days, 99th percentile

Nuclei

medium

Published

2021-09-17

Updated

2025-03-31

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Informatio…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39327.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_bulletproofsecu…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50382

References

• CVE Record
• NVD entry

Related

• CVE-2021-39322
• CVE-2021-39341
• CVE-2021-39320
• CVE-2021-39350
• CVE-2021-39316
• CVE-2021-39352