CVE-2021-39203: Private data disclosure/privilege escalation through the block editor in Wordpress
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpressto a version that resolves this vulnerability.Fixed in 5.8
Event History
Frequently Asked Questions
What is CVE-2021-39203?
CVE-2021-39203 is a vulnerability in WordPress that allows authenticated users without permission to view private post types/data to bypass restrictions in the block editor.
How does CVE-2021-39203 affect WordPress?
In affected versions, authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions.
What is the severity of CVE-2021-39203?
The severity of CVE-2021-39203 is medium with a CVSS score of 6.5.
How can I fix CVE-2021-39203 vulnerability in WordPress?
To fix the CVE-2021-39203 vulnerability in WordPress, consider upgrading to a version that includes the necessary security patches or follow the recommendations provided by WordPress.
Where can I find more information about CVE-2021-39203?
More information about CVE-2021-39203 can be found in the following references: - [GitHub Security Advisory](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6) - [HackerOne Report](https://hackerone.com/reports/1225282)