CVE-2024-0680: WP Private Content Plus <= 3.6 - Protection Mechanism Bypass
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0680?
CVE-2024-0680 is rated as a high-severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2024-0680?
To fix CVE-2024-0680, update the WP Private Content Plus plugin to version 3.6.1 or later.
What are the impacted versions for CVE-2024-0680?
CVE-2024-0680 affects all versions of WP Private Content Plus up to and including 3.6.
Who is affected by CVE-2024-0680?
Users of the WP Private Content Plus plugin for WordPress with versions up to 3.6 are affected by CVE-2024-0680.
What type of vulnerability is CVE-2024-0680?
CVE-2024-0680 is an information disclosure vulnerability stemming from improper access restrictions in the REST API.