WordPress Patreon WordPress plugin <= 1.6.9 - Local File Disclosure vulnerability - Patchstack

Vulnerability Database

WordPress Patreon WordPress plugin <= 1.6.9 - Local File Disclosure vulnerability

patreon-connect

Software

Patreon WordPress

Versions

<= 1.6.9

Disclosure date

2021-03-26

CVE

CVE-2021-24227

References

CVE
Vulnerability details
Plugin changelog

Credits

Jetpack Scan team

Classification

Information Disclosure

OWASP Top 10

A3: Sensitive Data Exposure

CVSS 3.0 score

7.5

High

Are your websites subject to this vulnerability?

Details

Local File Disclosure vulnerability discovered by Jetpack Scan team in WordPress Patreon WordPress plugin (versions <= 1.6.9).

Solution

Update the WordPress Patreon WordPress plugin to the latest available version (at least 1.7.0).

Found a vulnerability that puts your sites at risk?

Found a vulnerability? Help us secure the web and join our community of ethical hackers.

Are you the developer of this software? Hire our researchers for a thorough security audit.