Unauthorized Data Access in Spacer Plugin by WordPress

CVE-2024-10527

What is CVE-2024-10527?

The Spacer plugin for WordPress is subject to a security concern that stems from a missing capability check in the motech_spacer_callback() function. This issue affects all versions of the plugin up to and including 3.0.7, allowing authenticated attackers with Subscriber-level access or higher to potentially access and view sensitive setting information. This vulnerability underscores the importance of proper access control mechanisms within WordPress plugins to protect user data.

References