Vulnerability Description
The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Theandystratton | Pagerestrict | <= 2.5.5 |
Related Weaknesses (CWE)
References
- https://wordpress.org/plugins/pagerestrict/Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/63f98fd6-eee8-4281-98eThird Party Advisory
- https://wordpress.org/plugins/pagerestrict/Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/63f98fd6-eee8-4281-98eThird Party Advisory
FAQ
What is CVE-2024-0682?
CVE-2024-0682 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the R...
How severe is CVE-2024-0682?
CVE-2024-0682 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-0682?
Check the references section above for vendor advisories and patch information. Affected products include: Theandystratton Pagerestrict.