Which products and versions are affected by CVE-2021-38314?

Affected: Gutenberg Template Library \& Redux Framework (Redux); redux-framework (wordpress-plugin); Gutenberg Template Library & Redux Framework versions >= 4.2.11. The full list is in the CVE brief.

Is CVE-2021-38314 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-38314 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-38314?

No public exploit code is known.

How urgently should CVE-2021-38314 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

Vulnerability Intelligence

CVE-2021-38314

Medium

Published Sep 2, 2021 · Updated Jul 9, 2026 · Also known as 5b5c2a74-c1e8-4381-8d0d-66a2ed3b937e

Key Facts

Routine patching

CVE-2021-38314 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Gutenberg Template Library \& Redux Framework (Redux), redux-framework (wordpress-plugin), Gutenberg Template Library & Redux Framework.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 29% probability of exploitation in the next 30 days.
Fixed versions are available, including Gutenberg Template Library \& Redux Framework <=4.2.11, redux-framework 4.2.13, Gutenberg Template Library \& Redux Framework 4.2.11.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS (30-day exploit likelihood)

29%

Higher than 98.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-38314 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s AUTH_KEY concatenated with the SECURE_AUTH_KEY.

Affected Products

3 affected entries in total

Product	Affected versions	Fixed in
Gutenberg Template Library \& Redux FrameworkRedux	See advisory	4.2.11
redux-frameworkwordpress-plugin	See advisory	4.2.13
Gutenberg Template Library & Redux Framework	>= 4.2.11	n/a

Patched Releases

Gutenberg Template Library \& Redux Framework

<=4.2.11

redux-framework

4.2.13

Timeline

Publicly disclosed
Sep 2, 2021
Last updated
Jul 9, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-760 Use of a One-Way Hash with a Predictable Salt
CWE-916 Use of Password Hash With Insufficient Computational Effort

References

FAQ

Common Questions.

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of…
Affected: Gutenberg Template Library \& Redux Framework (Redux); redux-framework (wordpress-plugin); Gutenberg Template Library & Redux Framework versions >= 4.2.11. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Gutenberg Template Library \& Redux Framework <=4.2.11, redux-framework 4.2.13, Gutenberg Template Library \& Redux Framework 4.2.11.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2021-38314 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.