VULNERABILITY INTELLIGENCE

CVE-2021-24227

CVSS score7.5 HIGH
EPSS probability5.93%
CISA KEVNot currently listed
Published2021-04-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.

Weakness classification

  • contact@wpscan.com: CWE-200
  • nvd@nist.gov: CWE-200

Primary references