WP Private Content Plus <= 3.6 - Protection Mechanism Bypass
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
nimeshrmr · WP Private Content PlusReferences
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3046309%40wp-private-content-plus&new=3046309%40wp-private-content-plus&sfp_email=&sfph_mail=https://wordpress.org/plugins/wp-private-content-plus/https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8904f-3bc9-4c67-b44b-8d78762b6b30?source=cve