Skip to content
Fencer Vulns
medium 6.5

CVE-2021-24997 json

WP Guppy < 1.3 - Sensitive Information Disclosure

published 2021-12-27 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-11909

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known, plus a Nuclei check

Summary

The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user

Patch / fix

  • wp-guppy wp_guppy 1.3

Exploit prediction

2.80% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template WordPress Guppy <=1.1 - Information Disclosure nuclei detection template
  • wpscan.com https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/Keyvanhardani/WP-Guppy-A-live-chat-WP-JSON-API-Sensitive-Information-Disclosure referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • Unknown WP Guppy

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.