CVE-2024-11083 — Sensitive Information Exposure in Profilepress

CWE-200 — Sensitive Information Exposure2 documents2 sources
Severity
5.3MEDIUMNVD
EPSS
0.8%
top 25.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Properfraction Profilepress
Timeline
PublishedNov 27

Description

The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

1
GHSA
GHSA-w6gg-264j-7prm: The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4↗2024-11-27
▶