CVE-2021-38314

🗓️ 02 Sep 2021 16:53:54Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 290 Views🌐 WEB

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress allows unauthenticated users to access sensitive information via unique but predictable AJAX actions

Reporter	Title	Published	Views	Family All 24
GithubExploit	Exploit for Use of a One-Way Hash with a Predictable Salt in Redux Gutenberg_Template_Library_\&_Redux_Framework	26 Jun 202217:23	–	githubexploit
GithubExploit	Exploit for Use of a One-Way Hash with a Predictable Salt in Redux Gutenberg_Template_Library_\&_Redux_Framework	15 May 202202:10	–	githubexploit
GithubExploit	Exploit for Use of a One-Way Hash with a Predictable Salt in Redux Gutenberg_Template_Library_\&_Redux_Framework	7 Dec 202115:39	–	githubexploit
GithubExploit	Exploit for Use of a One-Way Hash with a Predictable Salt in Redux Gutenberg_Template_Library_\&_Redux_Framework	8 Sep 202209:08	–	githubexploit
Circl	CVE-2021-38314	4 Dec 202117:11	–	circl
CNNVD	WordPress 插件安全漏洞	2 Sep 202100:00	–	cnnvd
Cvelist	CVE-2021-38314 Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure	2 Sep 202116:53	–	cvelist
Hacker One	MTN Group: CVE-2021-38314 @ https://www.mtn.ci	26 Sep 202109:09	–	hackerone
Hacker One	MTN Group: CVE-2021-38314 @ https://www.mtn.co.rw	26 Sep 202109:17	–	hackerone
Hacker One	Mars: Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314	18 Jan 202215:07	–	hackerone

NVD

Vulners

Node

redux gutenberg_template_library_&_redux_frameworkRange≤4.2.11wordpress

[
  {
    "product": "Gutenberg Template Library & Redux Framework",
    "vendor": "Redux.io",
    "versions": [
      {
        "lessThanOrEqual": "4.2.11",
        "status": "affected",
        "version": "4.2.11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/

Parameter	Position	Path	Description	CWE
action	query param	wp-admin/admin-ajax.php?action=16a8ca2d7a9690742c2048ec7b7f0f56	Unauthenticated endpoint used to retrieve a hash seed for further exploitation, enabling disclosure of sensitive information.	CWE-916, CWE-200, CWE-760
redux_framework_disable_tracking	request body	wp-admin/admin-ajax.php?action=30cf1a163dd8a8787885585aee1e1973	Secondary unauthenticated AJAX action used to modify plugin settings and potentially expose sensitive information, based on values derived from prior hashes.	CWE-916, CWE-200, CWE-760
action	request body	wp-admin/admin-ajax.php?action=30cf1a163dd8a8787885585aee1e1973	Secondary unauthenticated AJAX action used to modify plugin settings and potentially expose sensitive information, based on values derived from prior hashes.	CWE-916, CWE-200, CWE-760
hash	request body	wp-admin/admin-ajax.php?action=30cf1a163dd8a8787885585aee1e1973	Secondary unauthenticated AJAX action used to modify plugin settings and potentially expose sensitive information, based on values derived from prior hashes.	CWE-916, CWE-200, CWE-760
code	request body	wp-admin/admin-ajax.php?action=30cf1a163dd8a8787885585aee1e1973	Secondary unauthenticated AJAX action used to modify plugin settings and potentially expose sensitive information, based on values derived from prior hashes.	CWE-916, CWE-200, CWE-760

17 Jun 2026 04:01Current

5.2Medium risk

Vulners AI Score5.2

CVSS 25

CVSS 3.15.3

EPSS0.28961

SSVC

cve-2021-38314 gutenberg template library redux framework wordpress security vulnerability ajax actions unauthenticated access information disclosure nvd