Sensitive Information Exposure in Passster WordPress Plugin by WordPress
CVE-2024-0616

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Passster – Password Protect Pages and Content
Vendor
CVE Published:
29 February 2024

Summary

The Passster plugin for WordPress, used for password protecting pages and content, is vulnerable to sensitive information exposure. This issue affects all versions up to 4.2.6.2 and allows unauthorized attackers to access sensitive data via the API. Consequently, attackers could retrieve post titles, slugs, IDs, content, and even passwords associated with protected posts and pages, leading to unauthorized disclosure of sensitive information.

Affected Version(s)

Passster – Password Protect Pages and Content * <= 4.2.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.