WordPress Plugin Vulnerabilities

StreamWeasels Twitch Integration < 1.8.0 - Unauthenticated Sensitive Information Exposure

Description

The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.8 via the sw-twitch-embed shortcode. This makes it possible for unauthenticated attackers to view potentially sensitive information.

Affects Plugins

Plugin icon
streamweasels-twitch-integration
Fixed in 1.8.0

References

CVE
CVE-2024-32716
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0d7b3f2a-0a82-4cd4-96a9-2b1257d7b13c

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Majed Refaea
Verified
No
WPVDB ID
57045f77-5dda-4fb2-9688-9460e838b2b1

Timeline

Publicly Published
2024-04-22 (about 2 years ago)
Added
2024-04-30 (about 2 years ago)
Last Updated
2024-04-30 (about 2 years ago)

Other

Published
Title
Published
2024-07-31
Title
CTT Expresso para WooCommerce < 3.2.13 - Information Exposure via Unprotected Directory
Published
2026-01-16
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.28 - Unauthenticated Information Exposure
Published
2025-11-03
Title
Backup Migration < 2.0.0 - Unauthenticated Backup Download
Published
2026-07-28
Title
Vimeo <= 1.2.2 - Authenticated (Subscriber+) Information Exposure
Published
2024-01-03
Title
Constant Contact Forms < 2.4.3 - Information Disclosure via Log Files