GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-38312 (GCVE-0-2021-38312)

Vulnerability from cvelistv5 – Published: 2021-09-02 16:53 – Updated: 2025-05-05 14:50
VLAI
Title
Gutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion
Summary
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-05 14:50 UTC
CWE
  • CWE-863 - Incorrect Authorization
  • CWE-280 - Improper Handling of Insufficient Permissions or Privileges
Assigner
References
Impacted products
Vendor Product Version CPE status
Redux.io Gutenberg Template Library & Redux Framework Affected: 4.2.11 , ≤ 4.2.11 (custom)
guessed Create a notification for this product.
Date Public
2021-09-01 00:00
Credits
Ramuel Gall, Wordfence
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:37:16.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-38312",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-05T14:50:01.700272Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-05T14:50:05.893Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Gutenberg Template Library \u0026 Redux Framework",
          "vendor": "Redux.io",
          "versions": [
            {
              "lessThanOrEqual": "4.2.11",
              "status": "affected",
              "version": "4.2.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ramuel Gall, Wordfence"
        }
      ],
      "datePublic": "2021-09-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the \u201credux/v1/templates/\u201d REST Route in \u201credux-templates/classes/class-api.php\u201d. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-280",
              "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-02T16:53:39.000Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@wordfence.com",
          "DATE_PUBLIC": "2021-09-01T00:00:00.000Z",
          "ID": "CVE-2021-38312",
          "STATE": "PUBLIC",
          "TITLE": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Gutenberg Template Library \u0026 Redux Framework",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "4.2.11",
                            "version_value": "4.2.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Redux.io"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Ramuel Gall, Wordfence"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the \u201credux/v1/templates/\u201d REST Route in \u201credux-templates/classes/class-api.php\u201d. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-863 Incorrect Authorization"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-280 Improper Handling of Insufficient Permissions or Privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/",
              "refsource": "MISC",
              "url": "https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/"
            }
          ]
        },
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2021-38312",
    "datePublished": "2021-09-02T16:53:39.328Z",
    "dateReserved": "2021-08-09T00:00:00.000Z",
    "dateUpdated": "2025-05-05T14:50:05.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-38312",
      "date": "2026-09-16",
      "epss": "0.01341",
      "percentile": "0.69907"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redux:gutenberg_template_library_\\\\\u0026_redux_framework:*:*:*:*:*:wordpress:*:*\", \"versionEndIncluding\": \"4.2.11\", \"matchCriteriaId\": \"8A4CBC31-7B53-462B-B51E-385476AF1E0E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the \\u201credux/v1/templates/\\u201d REST Route in \\u201credux-templates/classes/class-api.php\\u201d. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.\"}, {\"lang\": \"es\", \"value\": \"El plugin Gutenberg Template Library \u0026amp; Redux Framework versiones anteriores a 4.2.11 incluy\\u00e9ndola para WordPress, usaba una comprobaci\\u00f3n de autorizaci\\u00f3n incorrecta en los endpoints de la API REST registrados bajo la ruta REST \\\"redux/v1/templates/\\\" en el archivo \\\"redux-templates/classes/class-api.php\\\". El \\\"permissions_callback usado en este archivo s\\u00f3lo comprobaba la capacidad \\\"edit_posts\\\" que se concede a usuarios con menos privilegios, como los colaboradores, permitiendo a estos usuarios instalar plugins arbitrarios desde el repositorio de WordPress y editar entradas arbitrarias\"}]",
      "id": "CVE-2021-38312",
      "lastModified": "2024-11-21T06:16:46.467",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@wordfence.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.2}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:N/I:P/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-09-02T17:15:09.713",
      "references": "[{\"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\", \"source\": \"security@wordfence.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security@wordfence.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@wordfence.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-280\"}, {\"lang\": \"en\", \"value\": \"CWE-863\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-38312\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2021-09-02T17:15:09.713\",\"lastModified\":\"2024-11-21T06:16:46.467\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the \u201credux/v1/templates/\u201d REST Route in \u201credux-templates/classes/class-api.php\u201d. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.\"},{\"lang\":\"es\",\"value\":\"El plugin Gutenberg Template Library \u0026amp; Redux Framework versiones anteriores a 4.2.11 incluy\u00e9ndola para WordPress, usaba una comprobaci\u00f3n de autorizaci\u00f3n incorrecta en los endpoints de la API REST registrados bajo la ruta REST \\\"redux/v1/templates/\\\" en el archivo \\\"redux-templates/classes/class-api.php\\\". El \\\"permissions_callback usado en este archivo s\u00f3lo comprobaba la capacidad \\\"edit_posts\\\" que se concede a usuarios con menos privilegios, como los colaboradores, permitiendo a estos usuarios instalar plugins arbitrarios desde el repositorio de WordPress y editar entradas arbitrarias\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-280\"},{\"lang\":\"en\",\"value\":\"CWE-863\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redux:gutenberg_template_library_\\\\\u0026_redux_framework:*:*:*:*:*:wordpress:*:*\",\"versionEndIncluding\":\"4.2.11\",\"matchCriteriaId\":\"8A4CBC31-7B53-462B-B51E-385476AF1E0E\"}]}]}],\"references\":[{\"url\":\"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\",\"source\":\"security@wordfence.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T04:51:52+00:00",
      "cve": "CVE-2021-38312",
      "id": "CVE-2021-38312",
      "initial_release_date": "2021-09-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38312.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"product\": \"Gutenberg Template Library \u0026 Redux Framework\", \"vendor\": \"Redux.io\", \"versions\": [{\"lessThanOrEqual\": \"4.2.11\", \"status\": \"affected\", \"version\": \"4.2.11\", \"versionType\": \"custom\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Ramuel Gall, Wordfence\"}], \"datePublic\": \"2021-09-01T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the \\u201credux/v1/templates/\\u201d REST Route in \\u201credux-templates/classes/class-api.php\\u201d. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\", \"lang\": \"en\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-280\", \"description\": \"CWE-280 Improper Handling of Insufficient Permissions or Privileges\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2021-09-02T16:53:39.000Z\", \"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\"}], \"source\": {\"discovery\": \"INTERNAL\"}, \"title\": \"Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion\", \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security@wordfence.com\", \"DATE_PUBLIC\": \"2021-09-01T00:00:00.000Z\", \"ID\": \"CVE-2021-38312\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Gutenberg Template Library \u0026 Redux Framework \u003c= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Gutenberg Template Library \u0026 Redux Framework\", \"version\": {\"version_data\": [{\"version_affected\": \"\u003c=\", \"version_name\": \"4.2.11\", \"version_value\": \"4.2.11\"}]}}]}, \"vendor_name\": \"Redux.io\"}]}}, \"credit\": [{\"lang\": \"eng\", \"value\": \"Ramuel Gall, Wordfence\"}], \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"The Gutenberg Template Library \u0026 Redux Framework plugin \u003c= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the \\u201credux/v1/templates/\\u201d REST Route in \\u201credux-templates/classes/class-api.php\\u201d. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.\"}]}, \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-863 Incorrect Authorization\"}]}, {\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-280 Improper Handling of Insufficient Permissions or Privileges\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\", \"refsource\": \"MISC\", \"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\"}]}, \"source\": {\"discovery\": \"INTERNAL\"}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T01:37:16.465Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2021-38312\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-05T14:50:01.700272Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-05T14:49:57.627Z\"}}]}",
      "cveMetadata": "{\"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"assignerShortName\": \"Wordfence\", \"cveId\": \"CVE-2021-38312\", \"datePublished\": \"2021-09-02T16:53:39.328Z\", \"dateReserved\": \"2021-08-09T00:00:00.000Z\", \"dateUpdated\": \"2025-05-05T14:50:05.893Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.