blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24997

MEDIUM 6.5 CVSS 3.1
Published
December 27, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user

Affected products and versions

  • Unknown WP Guppy — From 1.3 (including) to 1.3 (excluding)
  • wp-guppy wp_guppy — Before 1.3

References

  • github.com https://github.com/Keyvanhardani/WP-Guppy-A-live-chat-WP-JSON-API-Sensitive-Information-Disclosure Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record