CVE-2021-39203 Private data disclosure/privilege escalation through the block editor in Wordpress
Authenticated users can bypass restrictions to view private post data and escalate privileges in the WordPress block editor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39203?
CVE-2021-39203 is a medium-severity missing authorization vulnerability in Wordpress Wordpress, published on 9 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
Weakness: CWE-200
Which versions are affected by CVE-2021-39203?
It affects 1 product.
Products include Wordpress Wordpress.
How do I fix CVE-2021-39203?
No fix has been published for CVE-2021-39203 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-39203 being exploited?
There is no known exploitation of CVE-2021-39203 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as UBUNTU-CVE-2021-39203.