CVE-2021-38312

🗓️ 02 Sep 2021 16:53:39Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 71 Views🌐 WEB

Gutenberg Template Library & Redux Framework plugin <= 4.2.11 vulnerabilit

Reporter	Title	Published	Views	Family All 16
CNNVD	WordPress 插件安全漏洞	2 Sep 202100:00	–	cnnvd
CNVD	WordPress Gutenberg Template Library	4 Sep 202100:00	–	cnvd
Cvelist	CVE-2021-38312 Gutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion	2 Sep 202116:53	–	cvelist
EUVD	EUVD-2021-24765	7 Oct 202500:30	–	euvd
NVD	CVE-2021-38312	2 Sep 202117:15	–	nvd
OpenVAS	WordPress Gutenberg Template Library & Redux Framework Plugin < 4.2.13 Multiple Vulnerabilities	30 Sep 202100:00	–	openvas
Patchstack	WordPress WP Mail Logging plugin <= 1.9.9 - Using Components with Known Vulnerabilities (vulnerable Redux Framework version)	29 Nov 202100:00	–	patchstack
Prion	Authorization	2 Sep 202117:15	–	prion
Positive Technologies	PT-2021-22030 · WordPress · The Gutenberg Template Library & Redux Framework	2 Sep 202100:00	–	ptsecurity
ThreatPost	Gutenberg Template Library & Redux Framework Bugs Plague WordPress Sites	1 Sep 202117:58	–	threatpost

NVD

Vulners

Node

redux gutenberg_template_library_&_redux_frameworkRange≤4.2.11wordpress

[
  {
    "product": "Gutenberg Template Library & Redux Framework",
    "vendor": "Redux.io",
    "versions": [
      {
        "lessThanOrEqual": "4.2.11",
        "status": "affected",
        "version": "4.2.11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/

Parameter	Position	Path	Description	CWE
action	query param	wp-admin/admin-ajax.php?action=16a8ca2d7a9690742c2048ec7b7f0f56	Insufficient authorization in redux/v1 templates REST endpoints allowing lower-privileged users to trigger sensitive actions.	CWE-863, CWE-280
action	query param	wp-admin/admin-ajax.php?action=30cf1a163dd8a8787885585aee1e1973&redux_framework_disable_tracking=tru	Unauthenticated access to modify plugin settings via redux framework (e.g., enabling/disabling logging) through vulnerable admin-ajax endpoint.	CWE-863, CWE-280
redux_framework_disable_tracking	query param	wp-admin/admin-ajax.php?action=30cf1a163dd8a8787885585aee1e1973&redux_framework_disable_tracking=tru	Unauthenticated access to modify plugin settings via redux framework (e.g., enabling/disabling logging) through vulnerable admin-ajax endpoint.	CWE-863, CWE-280

17 Jun 2026 04:01Current

5.8Medium risk

Vulners AI Score5.8

CVSS 24

CVSS 3.16.5 - 7.1

EPSS0.01341

SSVC