CVEvulnerability
CVE-2024-0680
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-02-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-693
Description
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
Affected configurations
• wpexpertdeveloper wp private content plus (< 3.6.1)
Related
Weakness · CWE (1)
- CWE-693 Protection Mechanism Failure weakness
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3046309%40wp-private-content-plus&new=3046309%40wp-private-content-plus&sfp_email=&sfph_mail= plugins.trac.wordpress.org
- https://wordpress.org/plugins/wp-private-content-plus/ Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8904f-3bc9-4c67-b44b-8d78762b6b30?source=cve Third Party Advisory
- https://wordpress.org/plugins/wp-private-content-plus/ Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8904f-3bc9-4c67-b44b-8d78762b6b30?source=cve Third Party Advisory