How severe is CVE-2021-39327?

CVE-2021-39327 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2021-39327 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 72% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-39327?

CVE-2021-39327 affects Ait-pro Bulletproof Security. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-39327?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-39327 published?

CVE-2021-39327 was published on 2021-09-17 and last updated on 2026-06-17.

CVE-2021-39327

CVE-2021-39327 is a medium-severity vulnerability in Ait-pro Bulletproof Security with a CVSS 3.x base score of 5.3. Its EPSS exploit-prediction score of 72% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-459.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 72% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-459
Affected product: Ait-pro Bulletproof Security
Published: 2021-09-17
Last modified: 2026-06-17

Description

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

Frequently asked questions

What is CVE-2021-39327?: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
How severe is CVE-2021-39327?: CVE-2021-39327 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2021-39327 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 72% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-39327?: CVE-2021-39327 affects Ait-pro Bulletproof Security. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-39327?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-39327 published?: CVE-2021-39327 was published on 2021-09-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:ait-pro:bulletproof_security:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Ait-pro Bulletproof Security

CVE-2014-7959 — Medium (CVSS 6.5): SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for…
CVE-2014-8749 — Medium (CVSS 5.0): Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin…
CVE-2022-1265 — Medium (CVSS 4.8): The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which…
CVE-2022-0590 — Medium (CVSS 4.8): The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could…
CVE-2015-9230 — Medium (CVSS 4.8): In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for…
CVE-2014-7958 — Medium (CVSS 4.3): Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before…

All CVEs affecting Ait-pro Bulletproof Security →

Other CWE-459 vulnerabilities

CVE-2023-36468 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki…
CVE-2022-45347 — Critical (CVSS 9.8): Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session…
CVE-2021-45330 — Critical (CVSS 9.8): An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies…
CVE-2021-45706 — Critical (CVSS 9.8): An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
CVE-2021-32928 — Critical (CVSS 9.8): The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License…
CVE-2020-13451 — Critical (CVSS 9.8): An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to…

Browse all CWE-459 vulnerabilities →