Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2021-39203

Private data disclosure/privilege escalation through the block editor in Wordpress

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WordPress wordpress-develop

  • 5.8 beta 1affected

References