Sensitive Information Exposure Vulnerability in The Last Viewed Posts Plugin

CVE-2024-12294

Summary

The Last Viewed Posts by WPBeginner plugin for WordPress is susceptible to a vulnerability that allows unauthenticated attackers to gain access to sensitive information. This includes titles and permalinks of posts that are private, password-protected, pending, or in draft status. The vulnerability lies within the 'get_legacy_cookies' function, which fails to properly secure sensitive data, resulting in potential data exposure for website administrators and users. Users who have installed versions of the plugin up to and including 1.0.1 should take immediate action to secure their sites against possible data breaches.

References