CVE-2024-11292mediumCWE-200

CVE-2024-11292: medium-severity vulnerability in nimeshrmr WP Private Content Plus

WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

Published · Updated

Follow this CVE+ Monitor WP Private Content Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
nimeshrmr · WP Private Content Plus
Related CVEs — nimeshrmr WP Private Content Plus

In the same product, most dangerous first.

CVE-2024-0680MEDIUMWP Private Content Plus <= 3.6 - Protection Mechanism BypassEPSS 0.6%CVE-2021-4385MEDIUMWP Private Content Plus <= 3.1 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2025-4390MEDIUMWP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information ExposureEPSS 0.4%