CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4.
Explanation of Vulnerability in Simple Terms
All In One WP Security & Firewall versions up to 5.2.4 expose sensitive information through improper access controls. An unauthenticated attacker can retrieve limited confidential data by exploiting network-accessible endpoints. The vulnerability requires specific conditions to trigger and has low confidentiality impact. Update to a version newer than 5.2.4 to remediate.
What an attacker can do
Read limited sensitive information from the plugin without authentication.
Potential impact on your site
Sensitive data may be exposed to unauthenticated visitors; update the plugin to patch the information disclosure.
Conditions required to exploit
Network access to the WordPress site; specific conditions must be met to trigger the vulnerability.
Key dates
External resources
Related vulnerabilities
