CVE-2021-39327: BulletProof Security WordPress plugin exposes paths via db_backup_log.txt

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw only leaks path information (CVSS 5.3, medium) but has public exploit code and a very high EPSS score, making it a likely reconnaissance step rather than a direct compromise.

What it is

The BulletProof Security WordPress plugin writes a publicly accessible db_backup_log.txt file that discloses the site's full filesystem path and the paths of database backup files. This is a path disclosure issue affecting versions up to and including 5.1, and the leaked paths can feed follow-on attacks against the site and its backups.

Impact

An unauthenticated attacker gains the server filesystem path of the WordPress installation and the location of database backup files, which aids further targeting of the site and its backups. No direct data modification or code execution is provided by this flaw alone.

Attack surface

Reachable over the network by requesting the db_backup_log.txt file directly; no authentication and no user interaction are required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The file is publicly accessible by design of the vulnerable plugin.

Exploitation

Public exploit code exists (Exploit-DB 50382, Packet Storm, and a GitHub PoC), and EPSS is 0.71688 (99.39th percentile), indicating high likelihood of attempted exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded.

What to do

• Update the BulletProof Security plugin to a version newer than 5.1, which contains the patch referenced in the plugin trac changeset.
• If immediate patching is not possible, block or restrict access to db_backup_log.txt and similar log files at the web server or WAF.
• Move database backup files outside the web root and remove any publicly reachable backup or log artifacts.
• Audit the web root for other exposed log, backup, or configuration files and remove them.
• Monitor plugin advisories and apply vendor updates promptly.

Detection

• Search web server access logs for requests to /db_backup_log.txt and other backup or log file paths.
• Alert on HTTP 200 responses to requests for .txt, .log, .sql, or .bak files within the WordPress directory.
• Scan the web root for publicly accessible backup and log files and flag any that return content.
• Correlate requests for disclosed backup paths with subsequent access attempts to those files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.