CVE-2024-6477: UsersWP < 1.2.12 - Users Information Disclosure
Published Aug 3, 2024
·Updated
The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address
Affected Software
2 affected components
UsersWP UsersWP<1.2.12
AyeCode Userswp Wordpress<1.2.12
Event History
Aug 3, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-6477?
CVE-2024-6477 has a severity level of medium due to the potential exposure of sensitive information.
2
How do I fix CVE-2024-6477?
To fix CVE-2024-6477, update the UsersWP WordPress plugin to version 1.2.12 or later.
3
What kind of information can be exposed by CVE-2024-6477?
CVE-2024-6477 could expose sensitive information including IP addresses, usernames, and email addresses.
4
Who is affected by CVE-2024-6477?
UsersWP plugin versions before 1.2.12 are affected by CVE-2024-6477.
5
Can attackers exploit CVE-2024-6477 if they are unauthenticated?
Yes, unauthenticated attackers can exploit CVE-2024-6477 due to predictable filenames used for exported data.