CVE-2021-39327

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

• CWE-200
• CWE-459

• http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/50382Exploit, Third Party Advisory, VDB Entry
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327Third Party Advisory
• http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39327Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.exploit-db.com/exploits/50382Exploit, Third Party Advisory, VDB Entry
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327Third Party Advisory

Published

Sep 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39320The underConstruction plugin <= 1.18 for WordPress echoes ou…6.1
• CVE-2021-39321Version 3.3.23 of the Sassy Social Share WordPress plugin is…8.8
• CVE-2021-39322The Easy Social Icons plugin <= 3.0.8 for WordPress echoes o…6.1
• CVE-2021-39324Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-39325The OptinMonster WordPress plugin is vulnerable to Reflected…6.1
• CVE-2021-39326Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-39328The Simple Job Board WordPress plugin is vulnerable to Store…4.8
• CVE-2021-39329The JobBoardWP WordPress plugin is vulnerable to Stored Cros…4.8
• CVE-2021-3933An integer overflow could occur when OpenEXR processes a cra…5.5
• CVE-2021-39330Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-39332The Business Manager WordPress plugin is vulnerable to Store…4.8
• CVE-2021-39333The Hashthemes Demo Importer Plugin <= 1.1.1 for WordPress c…8.1