CVE-2021-39327

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

71.69%

Published

Sep 17, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (3)

All weaponized →

Exploit-DBWordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200CWE-459

Affected Products (1)

ait-pro · bulletproof_securityvulnerable

References (10)

http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327

ExploitThird Party Advisory

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail=