Medium
wordpress — security advisory
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
- Products
- wordpress
- Affected versions
- 4.3+dfsg-1, 4.3.1+dfsg-1, 4.4+dfsg-1, 4.4.1+dfsg-1, 4.4.2+dfsg-1, 4.4.2+dfsg-1ubuntu1, 4.8.2+dfsg-2, 4.8.3+dfsg-1, 4.9.1+dfsg-1, 4.9.2+dfsg-1, 4.9.4+dfsg-1, 4.9.5+dfsg1-1, 5.2.2+dfsg1-1, 5.2.4+dfsg1-1, 5.3.2+dfsg1-1, 5.3.2+dfsg1-1ubuntu1, 5.7.1+dfsg1-2ubuntu1, 5.8.1+dfsg1-2ubuntu1, 5.8.2+dfsg1-1ubuntu1, 5.8.3+dfsg1-1ubuntu1, 5.8.3+dfsg1-1ubuntu1.1, 6.2+dfsg1-1ubuntu1, 6.4.3+dfsg1-1ubuntu1, 6.7.2+dfsg1-1.1ubuntu1, 6.7.2+dfsg1-1.1ubuntu2
- Fixed versions
- Not specified
- CVEs
- CVE-2021-29450
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:34 UTC · Revision 1
Source evidence
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
osv:UBUNTU-CVE-2021-29450
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
wordpress
Fixed versions: Not specified
Complete source record
{
"id": "2c301d24b94fa89234b60e4fa77cb507fab7ecf5e99b155841d1341d05d5049a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-29450",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2021-29450",
"summary": "Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.",
"evidence": "osv:UBUNTU-CVE-2021-29450",
"products": [
{
"name": {
"value": "wordpress",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.3.1+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.4+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.1+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.2+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "4.4.2+dfsg-1ubuntu1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.8.2+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.8.3+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.9.1+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.9.2+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.9.4+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.9.5+dfsg1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.2+dfsg1-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.4+dfsg1-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.3.2+dfsg1-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.3.2+dfsg1-1ubuntu1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.7.1+dfsg1-2ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "5.8.1+dfsg1-2ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "5.8.2+dfsg1-1ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "5.8.3+dfsg1-1ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "5.8.3+dfsg1-1ubuntu1.1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.2+dfsg1-1ubuntu1",
"evidence": "/affected/4/versions"
},
{
"value": "6.4.3+dfsg1-1ubuntu1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.7.2+dfsg1-1.1ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.7.2+dfsg1-1.1ubuntu2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.7.2+dfsg1-1.1ubuntu1",
"evidence": "/affected/7/versions"
},
{
"value": "6.7.2+dfsg1-1.1ubuntu2",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2021-29450",
"aliases": [
"UBUNTU-CVE-2021-29450"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "low"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"4.3+dfsg-1",
"4.3.1+dfsg-1",
"4.4+dfsg-1",
"4.4.1+dfsg-1",
"4.4.2+dfsg-1",
"4.4.2+dfsg-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "4.4.2+dfsg-1ubuntu1"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "4.4.2+dfsg-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentyfifteen",
"binary_version": "4.4.2+dfsg-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentyfourteen",
"binary_version": "4.4.2+dfsg-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentysixteen",
"binary_version": "4.4.2+dfsg-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"4.8.2+dfsg-2",
"4.8.3+dfsg-1",
"4.9.1+dfsg-1",
"4.9.2+dfsg-1",
"4.9.4+dfsg-1",
"4.9.5+dfsg1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "4.9.5+dfsg1-1"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "4.9.5+dfsg1-1"
},
{
"binary_name": "wordpress-theme-twentyfifteen",
"binary_version": "4.9.5+dfsg1-1"
},
{
"binary_name": "wordpress-theme-twentyseventeen",
"binary_version": "4.9.5+dfsg1-1"
},
{
"binary_name": "wordpress-theme-twentysixteen",
"binary_version": "4.9.5+dfsg1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"5.2.2+dfsg1-1",
"5.2.4+dfsg1-1",
"5.3.2+dfsg1-1",
"5.3.2+dfsg1-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "5.3.2+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "5.3.2+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentynineteen",
"binary_version": "5.3.2+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentyseventeen",
"binary_version": "5.3.2+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentysixteen",
"binary_version": "5.3.2+dfsg1-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"5.7.1+dfsg1-2ubuntu1",
"5.8.1+dfsg1-2ubuntu1",
"5.8.2+dfsg1-1ubuntu1",
"5.8.3+dfsg1-1ubuntu1",
"5.8.3+dfsg1-1ubuntu1.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "5.8.3+dfsg1-1ubuntu1.1"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "5.8.3+dfsg1-1ubuntu1.1"
},
{
"binary_name": "wordpress-theme-twentynineteen",
"binary_version": "5.8.3+dfsg1-1ubuntu1.1"
},
{
"binary_name": "wordpress-theme-twentytwenty",
"binary_version": "5.8.3+dfsg1-1ubuntu1.1"
},
{
"binary_name": "wordpress-theme-twentytwentyone",
"binary_version": "5.8.3+dfsg1-1ubuntu1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"6.2+dfsg1-1ubuntu1",
"6.4.3+dfsg1-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "6.4.3+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "6.4.3+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentytwentyfour",
"binary_version": "6.4.3+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentytwentythree",
"binary_version": "6.4.3+dfsg1-1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentytwentytwo",
"binary_version": "6.4.3+dfsg1-1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"6.7.2+dfsg1-1.1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "6.7.2+dfsg1-1.1ubuntu1"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "6.7.2+dfsg1-1.1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentytwentyfive",
"binary_version": "6.7.2+dfsg1-1.1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentytwentyfour",
"binary_version": "6.7.2+dfsg1-1.1ubuntu1"
},
{
"binary_name": "wordpress-theme-twentytwentythree",
"binary_version": "6.7.2+dfsg1-1.1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"6.7.2+dfsg1-1.1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-theme-twentytwentyfive",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-theme-twentytwentyfour",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-theme-twentytwentythree",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/ubuntu/wordpress?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"6.7.2+dfsg1-1.1ubuntu1",
"6.7.2+dfsg1-1.1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-29450.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "wordpress",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-l10n",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-theme-twentytwentyfive",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-theme-twentytwentyfour",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
},
{
"binary_name": "wordpress-theme-twentytwentythree",
"binary_version": "6.7.2+dfsg1-1.1ubuntu2"
}
]
}
}
],
"modified": "2026-10-17T12:55:45.587538752Z",
"provider": "osv",
"upstream": [
"CVE-2021-29450"
],
"references": [
"https://ubuntu.com/security/CVE-2021-29450",
"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhq",
"https://wordpress.org/news/category/security/",
"https://www.cve.org/CVERecord?id=CVE-2021-29450"
]
},
"related_cves": [
{
"value": "CVE-2021-29450",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354029,
"published_at": "2021-04-15T22:15:00+00:00"
}