Sensitive Information Exposure Vulnerability in The Last Viewed Posts Plugin
CVE-2024-12294
5.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 11 December 2024
What is CVE-2024-12294?
The Last Viewed Posts by WPBeginner plugin for WordPress is susceptible to a vulnerability that allows unauthenticated attackers to gain access to sensitive information. This includes titles and permalinks of posts that are private, password-protected, pending, or in draft status. The vulnerability lies within the 'get_legacy_cookies' function, which fails to properly secure sensitive data, resulting in potential data exposure for website administrators and users. Users who have installed versions of the plugin up to and including 1.0.1 should take immediate action to secure their sites against possible data breaches.
Affected Version(s)
Last Viewed Posts by WPBeginner * <= 1.0.1