What the vulnerability does
01Description
A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230672.
Explanation of Vulnerability in Simple Terms
02Summary
Exit Box Lite Plugin versions 1.06 and later expose sensitive information to authenticated users. An attacker with low-level site access can read data not intended for their privilege level. The vulnerability requires a valid user account but no additional user interaction. Site administrators should update to a patched version when available.
What an attacker can do
03Attacker Capabilities
Read sensitive information on the site that should be restricted to higher-privilege users.
Potential impact on your site
04Site Impact
User data or site configuration details may be exposed to low-privilege account holders.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
June 5, 2023
CVE published
August 6, 2024
Record updated
