CVE-2021-38314: Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
Redux.io · Gutenberg Template Library & Redux Framework
Affected: Redux.io Gutenberg Template Library & Redux Framework · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 98% of scored CVEs
DescriptionCVE.org
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Redux.io · Gutenberg Template Library & Redux Frameworkfrom 4.2.11 up to and including 4.2.11
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- WordPress Redux Framework <=4.2.11 - Information Disclosure · nuclei template in projectdiscovery/nuclei-templates
- Published
- September 2021
- Bounty reports
- 3 disclosed on HackerOne
Disclosed bug bounty reports about CVE-2021-38314
The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.
- Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314Mars · 2025 · medium severityValid
- CVE-2021-38314 @ https://www.mtn.co.rwMTN Group · 2022Valid
- CVE-2021-38314 @ https://www.mtn.ciMTN Group · 2022 · medium severityValid
CoverageNo articles yet
No CyberSIXT article names CVE-2021-38314 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.