The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
CVSS
No CVSS.
References
Configurations
History
07 Feb 2025, 01:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wpexpertdeveloper wp Private Content Plus
Wpexpertdeveloper |
|
| CPE | cpe:2.3:a:wpexpertdeveloper:wp_private_content_plus:*:*:*:*:*:wordpress:*:* | |
| CWE | NVD-CWE-noinfo | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8904f-3bc9-4c67-b44b-8d78762b6b30?source=cve - Third Party Advisory | |
| References | () https://wordpress.org/plugins/wp-private-content-plus/ - Product |
28 Feb 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-28 09:15
Updated : 2025-02-07 01:27
NVD link : CVE-2024-0680
Mitre link : CVE-2024-0680
JSON object : View
Products Affected
wpexpertdeveloper
- wp_private_content_plus
CWE