CVE-2021-38314
MediumPublished
Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
- Published
- Sep 2, 2021
- Updated
- May 5, 2025
- Assigning CNA
- Wordfence
- Evidence observed
- Aug 8, 2026
Primary CVSS
5.3/ 10Medium
Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NModerate · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
http/cves/2021/CVE-2021-38314.yaml
Exploit in python3 to explore CVE-2021-38314 in Redux Framework a wordpress plugin
CVE-2021-38314 Python Exploit
Python exploit for CVE-2021-38314 targeting unauthenticated information disclosure in the Gutenberg Template Library & Redux Framework WordPress plugin. Retrieves active plugins, PHP version, and site auth keys.
Python exploit for CVE-2021-38314 targeting unauthenticated sensitive information disclosure in WordPress Gutenberg Template Library & Redux Framework plugin <= 4.2.11.
Unauthenticated Sensitive Information Disclosure (CVE-2021–38314).
Proof-of-concept exploit for CVE-2021-38314 enabling unauthenticated sensitive information disclosure in WordPress plugins. Useful for security testing and vulnerability verification.
cve-2021-38314 - Unauthenticated Sensitive Information Disclosure
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.