Gutenberg Template Library & Redux Framework
Approved changes feed: RSS · Atom
cpe:2.3:a:redux:gutenberg_template_library_\&_redux_framework:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Redux (b0cfcb77-d119-50d0-b6b7-ad0967bde377) |
|---|---|
| Product | Gutenberg Template Library & Redux Framework (4cc1f876-e402-587a-b5c2-99b88885ba00) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-38314 |
vulnerable | 2026-06-08 05:32:55.872860 |
Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
MEDIUM (5.3)
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Published: 2021-09-02T16:53:54.200Z
Updated: 2025-05-05T14:49:49.173Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38312 |
vulnerable | 2026-06-08 05:32:55.872027 |
Gutenberg Template Library & Redux Framework <= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion
HIGH (7.1)
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
Published: 2021-09-02T16:53:39.328Z
Updated: 2025-05-05T14:50:05.893Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.