CVE-2024-13546: GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'
The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.1 via the 'getimagedescription' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private, draft, and scheduled posts and pages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13546?
CVE-2024-13546 is considered to be a moderate severity vulnerability due to the potential for sensitive information exposure.
How do I fix CVE-2024-13546?
To mitigate CVE-2024-13546, update the GenerateBlocks plugin to version 1.9.2 or later.
Who is affected by CVE-2024-13546?
CVE-2024-13546 affects all versions of the GenerateBlocks plugin up to and including version 1.9.1.
What type of vulnerability is CVE-2024-13546?
CVE-2024-13546 is classified as a sensitive information exposure vulnerability.
Can unauthenticated users exploit CVE-2024-13546?
No, CVE-2024-13546 can only be exploited by authenticated attackers with Contributor-level access and above.