CVE-2024-6499 — Sensitive Information Exposure in Maxbuttons

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 35.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Maxfoundry MaxbuttonsMaxfoundry Maxbuttons Create Buttons
Timeline
PublishedAug 24

Description

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure↗2024-08-24
▶
GHSA
GHSA-c9x2-m7q5-frxf: The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9↗2024-08-24
▶
CVE-2024-6499 — Sensitive Information Exposure | cvebase