CVE-2024-32825highCWE-201

CVE-2024-32825: high-severity vulnerability in Simply Static

WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerability

Published · Updated

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 2.0%
exploitation probability
2.0%top 20% of all CVEs
observed exploitation
nono source reports it
In short

The Simply Static WordPress plugin up to version 3.1.3 accidentally exposes sensitive information in log files that can be accessed by unauthorized users. This could reveal private data like credentials or configuration details.

Technical detail

CWE-201 vulnerability in Simply Static <= 3.1.3 allows unauthenticated or low-privileged attackers to access sensitive data (credentials, API keys, configuration parameters) through publicly or insufficiently protected log files. The plugin fails to sanitize or restrict access to logs containing sensitive information, enabling information disclosure without requiring code execution or complex exploitation.

Summary generated and translated by AI from the official description.
Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Simply Static · Simply Static
Related CVEs — Simply Static

In the same product, most dangerous first.

CVE-2024-30178MEDIUMWordPress Simply Static plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%
References
https://patchstack.com/database/vulnerability/simply-static/wordpress-simply-static-plugin-3-1-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cvehttps://patchstack.com/database/Wordpress/Plugin/simply-static/vulnerability/wordpress-simply-static-plugin-3-1-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve