WP Private Content Plus Plugin Sensitive Information Exposure via WordPress Search
CVE-2024-11292 Published on December 6, 2024
WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Timeline
Disclosed
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2024-11292 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2024-11292
Want to know whenever a new CVE is published for WordPress Wp Private Content Plus Plugin? stack.watch will email you.
Affected Versions
nimeshrmr WP Private Content Plus:- Before and including 3.6.1 is affected.
- Before and including 3.6.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.