CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute force attack.
Explanation of Vulnerability in Simple Terms
PrivateContent versions 8.4.3 and earlier contain a client-side information disclosure vulnerability. An attacker can read sensitive data that should be restricted, such as private content metadata or user information, by analyzing network traffic or client-side code. No authentication is required. The vulnerability does not allow modification or deletion of data.
What an attacker can do
Read sensitive data that should be restricted to authenticated users.
Potential impact on your site
Confidential information may be exposed to unauthenticated visitors without your knowledge.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
