CVE-2021-39327

BulletProof Security <= 5.1 Sensitive Information Disclosure

5.3 MediumPublic exploit

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

71.7%Up 71.1 points since Sep 18, 2021

What each source reports

CVE List Score used 5.3

BulletProof Security <= 5.1 Sensitive Information Disclosure

Record: CVE-2021-39327
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2021-25688 5.3

Record: EUVD-2021-25688
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6qg5-vf7x-4fm3 5.3

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due...

Record: GHSA-6qg5-vf7x-4fm3
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200, CWE-459
Updated: 2026-11-02

NVD 5.3

Record: CVE-2021-39327
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200, CWE-459
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure	2021-10-06
Metasploit	Wordpress BulletProof Security Backup Disclosure	2021-09-17
Nuclei	WordPress BulletProof Security 5.1 Information Disclosure

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-39327 is a medium vulnerability (CVSS 5.3) in Ait-pro Bulletproof Security, published September 17, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 71.7%, the 99th percentile. No source names a fixed version.