CVE-2024-1462: Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API
The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1462?
CVE-2024-1462 has been categorized as a medium severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2024-1462?
To fix CVE-2024-1462, upgrade the Maintenance Page plugin to version 1.0.9 or later.
Who is affected by CVE-2024-1462?
Any WordPress site using the Maintenance Page plugin version 1.0.8 or earlier is affected by CVE-2024-1462.
What type of information can be exposed by CVE-2024-1462?
CVE-2024-1462 can expose post titles and content from WordPress sites while they are in maintenance mode.
Is authentication required to exploit CVE-2024-1462?
No, unauthenticated attackers can exploit CVE-2024-1462 to access sensitive information.