CVE-2024-0680mediumCWE-693

CVE-2024-0680: medium-severity vulnerability in nimeshrmr WP Private Content Plus

WP Private Content Plus <= 3.6 - Protection Mechanism Bypass

Published · Updated

Follow this CVE+ Monitor WP Private Content Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
nimeshrmr · WP Private Content Plus
Related CVEs — nimeshrmr WP Private Content Plus

In the same product, most dangerous first.

CVE-2024-11292MEDIUMWP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureEPSS 0.5%CVE-2021-4385MEDIUMWP Private Content Plus <= 3.1 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2025-4390MEDIUMWP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information ExposureEPSS 0.4%