Is CVE-2021-32770 actively exploited?

No active exploitation of CVE-2021-32770 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-32770 be exploited remotely?

Yes. CVE-2021-32770 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-32770?

CVE-2021-32770 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2021-32770

HIGH

CVE-2021-32770

CWE-200Published: July 15, 2021· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround.

NVD Source

Technical Analysis

CVE-2021-32770 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.