WordPress Plugin Vulnerabilities
CorreosExpress <= 2.6.0 - Sensitive Information Disclosure
Description
The plugin generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses
Proof of Concept
https://example.com/wp-content/plugins/correos-express/log/log_cron_function.txt https://example.com/wp-content/plugins/correos-express/log/log_ordenes.txt https://example.com/wp-content/plugins/correos-express/log/log_rest.txt
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
José Aguilera
Submitter
José Aguilera
Submitter website
Verified
Yes
Timeline
Publicly Published
2021-11-29 (about 1 years ago)
Added
2022-02-03 (about 1 years ago)
Last Updated
2022-04-13 (about 1 years ago)