CVE-2024-1418 | THREATINT

Assigner	Wordfence
Reserved	2024-02-09
Published	2024-04-04
Updated	2024-06-04

Description

The CGC Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2 via the REST API. This makes it possible for unauthenticated attackers to view protected posts via REST API even when maintenance mode is enabled.

MEDIUM: 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-284 Improper Access Control

Product status

Default status

unaffected

affected

Timeline

2024-04-03:

Disclosed

Credits

Francesco Carlucci finder

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/1cd5fa89-ed3b-4ac1-9200-9f5eb26cb534?source=cve

https://wordpress.org/plugins/cgc-maintenance-mode/

cve.org CVE-2024-1418

nvd.nist.gov CVE-2024-1418

Download JSON