Information Exposure Vulnerability in WordPress Content No Cache Plugin
CVE-2024-12103

5.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Content No Cache | Serve Uncached Partial Content Even When You Add It To A Page That Is Fully Cached.
Vendor
CVE Published:
24 December 2024

What is CVE-2024-12103?

The Content No Cache plugin for WordPress has a significant vulnerability that allows unauthenticated attackers to access sensitive information. This issue arises from insufficient restrictions on the eos_dyn_get_content action, which permits the inclusion of post content without proper authentication. As a result, attackers may be able to retrieve data from password-protected, private, or draft posts, undermining the integrity and confidentiality of user data. Website administrators are advised to update to the latest version of the plugin or seek alternatives to safeguard their content.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Content No Cache | Serve uncached partial content even when you add it to a page that is fully cached. * <= 0.1.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3211815/cont...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
JSON
.