Log in Start free

Vulnerability · Published Sep 9, 2021 · Assigned by GitHub_M

CVE-2021-39200Information Disclosure in wp_die() via JSONP in wordpress

Medium 5.3

In plain English

A medium-severity information exposure in wordpress-develop from WordPress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.0%top 19.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12wordpress5.8.1+dfsg1-1DEBIAN-CVE-2021-39200
Debian:13wordpress5.8.1+dfsg1-1DEBIAN-CVE-2021-39200
Debian:14wordpress5.8.1+dfsg1-1DEBIAN-CVE-2021-39200
Ubuntu:22.04:LTSwordpressno fix listedUBUNTU-CVE-2021-39200
Ubuntu:24.04:LTSwordpressno fix listedUBUNTU-CVE-2021-39200
Ubuntu:25.10wordpressno fix listedUBUNTU-CVE-2021-39200
Ubuntu:26.04:LTSwordpressno fix listedUBUNTU-CVE-2021-39200
Ubuntu:26.10wordpressno fix listedUBUNTU-CVE-2021-39200

Affected products (as reported)

VendorProductVersions
WordPress wordpress-develop >= 5.2.0, < 5.8.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References