CVE-2024-11297: Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
First published: Fri Dec 20 2024(Updated: )
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Protect WP Pages/Post | <=1.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-11297?
CVE-2024-11297 is classified as a critical vulnerability due to its potential for sensitive information exposure.
How do I fix CVE-2024-11297?
To fix CVE-2024-11297, update the Page Restriction WordPress plugin to version 1.3.7 or later.
Who is affected by CVE-2024-11297?
CVE-2024-11297 affects all versions of the Page Restriction WordPress plugin up to and including version 1.3.6.
What is the impact of CVE-2024-11297?
The impact of CVE-2024-11297 allows unauthenticated attackers to exploit sensitive information through the WordPress core search feature.
Is there a workaround for CVE-2024-11297?
A temporary workaround for CVE-2024-11297 is to disable the Page Restriction WordPress plugin until an update can be applied.
- agent/author
- agent/references
- agent/type
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/first-publish-date
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wordpress
- canonical/wordpress protect wp pages/post