CVE-2021-24227: patreon patreon wordpress
Vulnerability summary
CVE-2021-24227 is a high (CVSS 7.5) vulnerability in patreon patreon wordpress. EPSS estimates a 5.93% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.7.0.
Timeline
- 12-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
5.93%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.93% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (jetpack.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Patreon1 product
- patreon wordpress< 1.7.0
Unknown1 product
- patreon wordpress≥ 1.7.0, < 1.7.0
Wordpress1 product
- patreon-connect< 1.7.0
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/f62df02d-7678-440f-84a1-ddbf09364016X Refsource CONFIRMThird Party Advisory
- jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/X Refsource MISCExploitThird Party Advisory