CVE-2021-39203

6.5 mediumEPSS 0.9%

Medium (6.5) in wordpress wordpress. EPSS 0.9% chance of exploitation in the next 30 days.

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2021-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wordpress:wordpress

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6
https://hackerone.com/reports/1225282
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6
https://hackerone.com/reports/1225282

Check your stack JSON