Sensitive Information Exposure in PPWP – Password Protect Pages Plugin for WordPress
CVE-2024-0620

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
PpWP – Password Protect Pages
Vendor
CVE Published:
29 February 2024

Summary

The Password Protect Pages plugin for WordPress is susceptible to sensitive information exposure due to improper handling of API requests. This vulnerability affects all versions up to and including 1.8.9. Unauthenticated attackers can exploit this flaw to access sensitive data, including post titles, IDs, and slugs, along with metadata for password-protected content. Such exposure can lead to further security risks, including unauthorized access to sensitive information that should remain protected.

Affected Version(s)

PPWP – Password Protect Pages * <= 1.8.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.