Now officially on WordPress.org

CVE Database / CVE-2021-38314

CVE · Medium

CVE-2021-38314 — Redux Framework [redux-framework] < 4.2.13

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2021-38314 Redux Framework [redux-framework] < 4.2.13 Exposure of Sensitive Information to an Unauthorized Actor Medium 5.3 < 4.2.13 4.2.13 2021-09-01 —

CVE-2021-38314

Redux Framework versions up to 4.2.11 exposed multiple AJAX endpoints to unauthenticated users that could be accessed using predictable nonces derived from the site URL with a fixed salt value. These accessible endpoints allowed attackers to retrieve sensitive information including the list of active plugins and their versions, the installed PHP version, and an unsalted MD5 hash of the site's authentication keys concatenated together. The vulnerability was resolved in version 4.2.13.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings