Caution: 2 WP Core Vulnerability APR 2021

WP CORE VULNERABILITY APR 2021

WP Core Vulnerability APR 2021:

Authenticated XXE Within the Media Library Affecting PHP 8

For your , be informed about the LATEST WP Core Vulnerability APR 2021. Publicly known since its first official report on 2021-04-15 or it’s official disclosure on 2021-04-28. All versions of WordPress starting with 5.6-5.7 have the Authenticated XXE Within the Media Library Affecting PHP 8 vulnerability.

WordPress 5.6-5.7 – Authenticated XXE Within the Media Library Affecting PHP 8
CVE-2021-29447
References: Changeset 29378


Impact – What can an attacker do:
A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. WordPress used an audio parsing library called ID3 that was affected by an XML External Entity (XXE) vulnerability affecting PHP versions 8 and above.

Get Healthy, Stay Healthy: A healthier online business starts today and it begins with you!

WP Core Vulnerability APR 2021:

Authenticated Password Protected Pages Exposure

For your , be informed about the LATEST WP Core Vulnerability APR 2021. Publicly known since its first official report on 2021-04-15 or it’s official disclosure on 2021-04-27. All versions of WordPress starting with 4.7-5.7 have the Authenticated Password Protected Pages Exposure vulnerability.

WordPress 4.7-5.7 – Authenticated Password Protected Pages Exposure
CVE-2021-29450
References: Changeset 50717


Impact – What can an attacker do:
The Latest Posts block in the WordPress editor can be exploited in a way that exposes password-protected posts and pages via the posts REST API when the “edit” context was used. This requires at least contributor privileges.

Protect your WordPress: BEFORE IT’S TOO LATE! You will also protect your customers, your reputation and your online business!

Related Posts

owl power EUROPE
×





error: Content is protected !!
Shopping cart
There are no products in the cart!
Continue shopping
0