WordPress Authenticated disclosure of password-protected pos… (CVE-2021-29450)

Summary

WordPress Authenticated disclosure of password-protected posts and pages

Original description

The description as published by the source.

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami wordpress

[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"5.7.1"}]}]

Bitnami wordpress-multisite

[{"type":"SEMVER","events":[{"introduced":"4.7.0"},{"fixed":"5.7.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-29450 wordpress Fixed in: 5.7.1+dfsg1-1
Ubuntu UBUNTU-CVE-2021-29450 wordpress

References

advisory github.com
advisory lists.debian.org
advisory wordpress.org
advisory debian.org
web nvd.nist.gov