WordPress Plugin Vulnerabilities

User Spam Remover < 1.1 - Unauthenticated Sensitive Information Exposure

Description

The User Spam Remover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 via a log file. This makes it possible for unauthenticated attackers to extract sensitive data from log files.

Affects Plugins

Plugin icon
user-spam-remover
Fixed in 1.1

References

CVE
CVE-2024-31298
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6efadbe7-ee9b-44cb-b7c6-4c38a872abf2

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
8ea71c95-0801-43bc-bb9e-591076fd428d

Timeline

Publicly Published
2024-04-05 (about 2 years ago)
Added
2024-04-11 (about 2 years ago)
Last Updated
2024-04-11 (about 2 years ago)

Other

Published
Title
Published
2026-07-24
Title
MapPress – Google Maps, OpenStreetMap & Leaflet < 2.97.7 - Unauthenticated Information Exposure
Published
2025-05-07
Title
Mail Mint < 1.17.8 - Unauthenticated Sensitive Information Exposure
Published
2024-11-20
Title
Sky Addons for Elementor < 2.6.2 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template
Published
2025-10-10
Title
Trinity Audio < 5.22.0 - Unauthenticated Information Exposure
Published
2026-06-08
Title
Payment forms, Buy now buttons, and Invoicing System | GetPaid < 2.8.50 - Unauthenticated Information Exposure