Sensitive Information Exposure in WP Customer Reviews Plugin by WordPress

CVE-2023-4686

Summary

The WP Customer Reviews plugin for WordPress is susceptible to a sensitive information exposure vulnerability in versions up to 3.6.6. This flaw allows authenticated attackers to access sensitive data, such as post titles and slugs, including those from protected and trashed posts, as well as other content types like galleries. By exploiting the ajax_enabled_posts function, an attacker can potentially compromise the data integrity and confidentiality of the WordPress site. Website owners using this plugin must apply the latest updates and review their access controls to mitigate risks.

References