CVE-2024-10671: Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure
The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btnblock] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10671?
CVE-2024-10671 has been assessed as a medium severity vulnerability due to potential information exposure.
How do I fix CVE-2024-10671?
To fix CVE-2024-10671, update the Button Block plugin to version 1.1.5 or later.
What type of vulnerability is CVE-2024-10671?
CVE-2024-10671 represents an information exposure vulnerability affecting the Button Block plugin.
Which versions of the Button Block are affected by CVE-2024-10671?
CVE-2024-10671 affects all versions of the Button Block plugin up to and including 1.1.4.
Can CVE-2024-10671 lead to unauthorized data access?
Yes, CVE-2024-10671 may allow unauthorized access to certain posts due to insufficient restrictions.