TI-2021-15920 Aliases CVE-2021-38312 GHSA-jgqj-hr6f-2p53

Incorrect authorization in Redux.io Gutenberg Template Library & Redux Framework

LOW 34CWE-280Published 2021-09-02 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01341 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Redux.io	Gutenberg Template Library & Redux Framework	4.2.11 – 4.2.11	—	No fix listed	CNA

Gutenberg Template Library & Redux Framework VendorRedux.io Affected 4.2.11 – 4.2.11 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redux:gutenberg_template_library_\&_redux_framework::::::wordpress::*	up to 4.2.11	Vulnerable	Redux

cpe:2.3:a:redux:gutenberg_template_library_\&_redux_framework:*:*:*:*:*:wordpress:*:* Versions up to 4.2.11 Vulnerable ·Redux

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-38312
2026-10-03 Alias added: GHSA-jgqj-hr6f-2p53

References

Exploit 1

https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/

TI-2021-15921 Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences