CyberSec.Space Logo
Back to CVE Browser

CVE-2021-24227

HIGH
7.5
CVSS Severity Score
EPSS Score0.0840%
EPSS Percentile43.28th
PublishedApr 12, 2021
Last ModifiedNov 21, 2024

Vulnerability Description

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.

Affected Platforms (CPE)

📦
Patreon

Patreon Wordpress

< 1.7.0

References & Advisories

🔗 https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
🔗 https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016
🔗 https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/
🔗 https://wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016

Related Vulnerabilities

CVE-2018-209849.8

The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.

CVE-2021-242289.6

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. ...

CVE-2021-242299.6

The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the...

CVE-2021-242308.1

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing...