CVE-2021-24227 Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
Unauthenticated attackers can leak sensitive internal files like wp-config.php from the Patreon WordPress plugin, exposing database credentials and keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24227?
CVE-2021-24227 is a high-severity vulnerability in Unknown Patreon WordPress, published on 12 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Weakness: CWE-200
Which versions are affected by CVE-2021-24227?
It affects 1 product.
Products include Patreon Patreon Wordpress.
How do I fix CVE-2021-24227?
No fix has been published for CVE-2021-24227 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24227 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24227 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Patreon WordPress
- CVE-2018-20984 Deserialization in n/a
- CVE-2021-24228 Patreon WordPress < 1.7.2 - Reflected XSS on Login Form
- CVE-2021-24229 Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action
- CVE-2021-24230 Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta
- CVE-2021-24231 Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon
Sources
Also known as GHSA-cc3j-r9g7-4r8c.