Vulnerability Description
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bplugins | Button Block | < 1.1.6 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset/3208482/button-blockPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ac55e988-2b41-459b-9abThird Party Advisory
FAQ
What is CVE-2024-12560?
CVE-2024-12560 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block...
How severe is CVE-2024-12560?
CVE-2024-12560 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-12560?
Check the references section above for vendor advisories and patch information. Affected products include: Bplugins Button Block.