CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.
Explanation of Vulnerability in Simple Terms
EmbedPress versions up to 3.7.3 expose sensitive API keys and credentials in the plugin's settings. An attacker on the network can read these secrets without authentication, potentially gaining access to third-party services integrated with the plugin. Update to a version newer than 3.7.3 to resolve this issue.
What an attacker can do
Read API keys and credentials stored in the plugin settings without logging in.
Potential impact on your site
Third-party service credentials (YouTube, PDF, social media APIs) exposed to anyone who can reach your site.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
