id: CVE-2021-39327 info: name: WordPress BulletProof Security 5.1 Information Disclosure author: geeknik severity: medium description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1. reference: - https://packetstormsecurity.com/files/164420/wpbulletproofsecurity51-disclose.txt - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 - https://nvd.nist.gov/vuln/detail/CVE-2021-39327 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-39327 cwe-id: CWE-200 tags: cve,cve2021,wordpress,exposures requests: - method: GET path: - '{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt' - '{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt' matchers-condition: and matchers: - type: word part: body words: - 'BPS DB BACKUP LOG' - '==================' condition: and - type: status status: - 200 - type: word part: header words: - 'text/plain' # Enhanced by mp on 2022/03/23