Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2021-39200: WordPress can leak sensitive data, allowing attackers to act on your behalf
CVE-2021-39200 · published 5 years ago
Summary
A security flaw in WordPress can leak sensitive information, potentially allowing attackers to perform actions on your website. This issue has been fixed in WordPress 5.8.1 and later versions, so updating your WordPress installation is strongly recommended to prevent potential attacks. Keep auto-updates enabled to ensure you receive the latest security patches.
What to do
- Update wordpress to version 5.8.1.
- Update debian wordpress to version 5.8.1+dfsg1-1.
- Update wordpress wordpress to version 5.8.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | wordpress |
>= 5.2.0, < 5.8.1 Fix: upgrade to 5.8.1
|
| – | wordpress | wordpress |
>= 5.2, < 5.8.1 cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 11.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | wordpress | All versions |
| Debian:12 | debian | wordpress |
< 5.8.1+dfsg1-1 Fix: upgrade to 5.8.1+dfsg1-1
|
Original advisory text
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked und...
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
References
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m9hc-7v5... Third Party Advisory
- https://www.debian.org/security/2021/dsa-4985 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-39200 URL
- https://ubuntu.com/security/CVE-2021-39200 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-39200 Third Party Advisory
- https://hackerone.com/reports/1142140 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-39200 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published9 Sep 2021
Updated4 Nov 2026
First seen13 Mar 2026
Sources
CVE-2021-39200 · OSV
GHSA-m9hc-7v5q-x8q5 · GHSA
BIT-wordpress-2021-39200 · OSV
CVE-2021-39200 · NVD
UBUNTU-CVE-2021-39200 · OSV
DEBIAN-CVE-2021-39200 · OSV
Track software like this
Free during beta