CVE-2021-24227: vulnerability in Patreon WordPress
Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
40Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 6.8%
from disclosure to weapon
Published on NVDApr 12
VulnCheck+986d
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Affected products
Unknown · Patreon WordPressRelated CVEs — Patreon WordPress
In the same product, most dangerous first.
CVE-2021-24228—Patreon WordPress < 1.7.2 - Reflected XSS on Login FormEPSS 1.9%CVE-2021-24229—Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionEPSS 1.8%CVE-2021-25026—Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24230—Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User MetaEPSS 0.6%CVE-2021-24231—Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From PatreonEPSS 0.6%CVE-2026-92431LOWPatreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationEPSS 0.2%