CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
Explanation of Vulnerability in Simple Terms
Defender Security plugin for WordPress versions up to 4.1.0 logs sensitive information in a way that allows unauthenticated attackers to read it. An attacker with network access can retrieve login credentials, API keys, or other confidential data stored in plugin logs without needing to authenticate or interact with a site administrator.
What an attacker can do
Read sensitive data like login credentials and API keys from plugin logs without authentication.
Potential impact on your site
Attackers can obtain credentials and secrets logged by the plugin, potentially leading to account compromise or further attacks.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
