WordPress Plugin Vulnerabilities

ElasticPress < 5.3.5 - Unauthenticated Information Exposure

Description

The ElasticPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.3.4. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
elasticpress
Fixed in 5.3.5

References

CVE
CVE-2026-62088
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2bde431d-a730-422c-a301-76e09df3d930

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
murloc.mrglwglwgl
Verified
No
WPVDB ID
b2e27454-8110-4e3b-b57d-7366e810cf38

Timeline

Publicly Published
2026-09-11 (about 1 month ago)
Added
2026-09-15 (about 1 month ago)
Last Updated
2026-09-15 (about 1 month ago)

Other

Published
Title
Published
2026-07-27
Title
Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute
Published
2024-07-26
Title
Intelligence <= 1.4.0 - Unauthenticated Full Path Disclosure
Published
2024-07-26
Title
Add Admin JavaScript <= 2.0 - Unauthenticated Full Path Dislcosure
Published
2026-03-13
Title
Doofinder for WooCommerce < 2.10.14 - Unauthenticated Information Exposure
Published
2022-04-23
Title
Metform Elementor Contact Form Builder < 2.1.4 - Unauthenticated API keys and Secrets Disclosure