Information Disclosure Vulnerability in FULL - Customer Plugin for WordPress

CVE-2023-4242

What is CVE-2023-4242?

The FULL - Customer plugin for WordPress suffers from an information disclosure vulnerability through the /health REST route in versions up to and including 2.2.3. This flaw arises due to improper authorization checks, allowing authenticated attackers with subscriber-level permissions or higher to access sensitive site configuration details exposed by the WordPress health check feature. If exploited, this vulnerability can lead to the leakage of critical information that may aid in further attacks against the affected website.

References