Description
The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.
Recommendation
Update the gatsby-source-wordpress package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0, < 5.9.2 < 4.0.8** Patched version(s): **5.9.2 4.0.8**
References
Could your website be exposed too?
SmartScanner can check your website for Basic-auth app bundle credential exposure in gatsby-source-wordpress and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
- Exposure of Sensitive Information to an Unauthorized Actor in nanoid - CVE-2021-23566
- Potential memory exposure in dns-packet - CVE-2021-23386
- Misinterpretation of malicious XML input - xmldom - CVE-2021-32796
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023