CVE-2021-39327: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers ...

Summary

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up t...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ait-pro	bulletproof_security	<= 5.1 `cpe:2.3:a:ait-pro:bulletproof_security::::::wordpress::*`

Original advisory text

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers ...

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

References

http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-I... Exploit Third Party Advisory VDB Entry
https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327 Exploit Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old... Patch Third Party Advisory
https://www.exploit-db.com/exploits/50382 Exploit Third Party Advisory VDB Entry
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327 Third Party Advisory