CVE-2024-0975

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0975
The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Make Website Members Only" feature (when unset) and view restricted page and post content.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:brandonwamboldt:wordpress_access_control:*:*:*:*:*:wordpress:*:*
History

07 Feb 2025, 01:11

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:brandonwamboldt:wordpress_access_control:*:*:*:*:*:wordpress:*:*
First Time Brandonwamboldt wordpress Access Control
Brandonwamboldt
References () https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289 - () https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve - Third Party Advisory

21 Nov 2024, 08:47

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289 - () https://plugins.trac.wordpress.org/browser/wordpress-access-control/trunk/wordpress-access-control.php#L289 -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/31f13524-2bd7-4157-b378-455ac4f822a1?source=cve -
Summary
  • (es) El complemento WordPress Access Control para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 4.0.13 incluida, a través de la API REST. Esto hace posible que atacantes no autenticados omitan la función "Hacer que el sitio web sea solo para miembros" del complemento (cuando no está configurada) y vean páginas restringidas y contenido de publicaciones.

28 Feb 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-28 09:15

Updated : 2025-02-07 01:11

NVD link : CVE-2024-0975

Mitre link : CVE-2024-0975

CVE.ORG link : CVE-2024-0975

JSON object : View

Products Affected

brandonwamboldt

  • wordpress_access_control
CWE
NVD-CWE-noinfo