CVE-2021-39203

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
WordPress	wordpress-develop	5.8 beta 1

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6Third Party Advisory
https://hackerone.com/reports/1225282Permissions Required
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6Third Party Advisory
https://hackerone.com/reports/1225282Permissions Required

Timeline

Published: Sep 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392047.5Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams w CVE-2021-392056.1Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting v CVE-2021-392068.6Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilitie CVE-2021-392078.8parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the pac CVE-2021-392084.3SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to part CVE-2021-392098.8GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site R CVE-2021-39214.3firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-392106.5GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a u CVE-2021-392115.3GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint disclose CVE-2021-392123.6ImageMagick is free software delivered as a ready-to-run binary distribution or as source code that you may use, copy, modify, and distribut CVE-2021-392138.8GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is v CVE-2021-392149.8mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perfo