Sensitive Information Exposure in Leyka Plugin for WordPress

CVE-2023-4917

Summary

The Leyka plugin for WordPress presents a serious vulnerability in versions up to 3.30.3, allowing authenticated users with subscriber-level permissions or above to exploit the 'leyka_ajax_get_env_and_options' function. This critical flaw enables attackers to retrieve sensitive information, including Sberbank API keys and passwords, as well as PayPal Client Secrets. Website administrators must act swiftly to update the plugin to secure their environments and protect their users' sensitive data from being compromised.

References