WordPress Plugin Vulnerabilities

Maintenance Mode < 3.0.2 - Unauthenticated Post/Page Content Disclosure

Description

The plugin is vulnerable to Sensitive Information Exposure via the REST API, allowing unauthenticated attackers to obtain post and page content via API thus bypassing the content protection provided by the plugin.

Affects Plugins

Plugin icon
hkdev-maintenance-mode
Fixed in 3.0.2

References

CVE
CVE-2024-1478
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/36def628-e09e-4da0-ab14-35aefcb67f73

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
6238154b-cdc2-4e1e-b387-20bea61971e2

Timeline

Publicly Published
2024-03-04 (about 2 years ago)
Added
2024-03-04 (about 2 years ago)
Last Updated
2024-04-01 (about 2 years ago)

Other

Published
Title
Published
2021-03-16
Title
wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Arbitrary Account Creation
Published
2024-12-19
Title
Maintenance & Coming Soon Redirect Animation < 2.3.0 - Missing Authorization to Settings Update
Published
2024-04-19
Title
VikBooking < 1.6.8 - Broken Access Control
Published
2021-09-06
Title
WordPress Automatic < 3.53.3 - Unauthenticated Arbitrary Options Update