CVE-2021-24227 Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

2021-04-1214:05:13

CWE-200

WPScan

www.cve.org

cve-2021-24227

unauthenticated

file disclosure

EPSS

0.03

Percentile

91.1%

JSON

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.

CNA Affected

[
  {
    "product": "Patreon WordPress",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.7.0",
        "status": "affected",
        "version": "1.7.0",
        "versionType": "custom"
      }
    ]
  }
]