CVE-2021-38314
Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
- Published
- Sep 2, 2021
- Updated
- May 5, 2025
- Assigning CNA
- Wordfence
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NModerate · next 30 days
- Percentile
- 98.1%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Sources
7- CVE-2021-38314Exploit
Exploit in python3 to explore CVE-2021-38314 in Redux Framework a wordpress plugin
- CVE-2021-38314Exploit
CVE-2021-38314 Python Exploit
- cve-2021-38314Exploit
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.