CVE-2024-2107 MEDIUM

CVE-2024-2107: Blossom Spa <= 1.3.3 - Sensitive Information Exposure

Vendor Blossomthemes

Product Blossom Spa

Weakness CWE-862 · Missing authorization

Published March 12, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

5.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This makes it possible for unauthenticated attackers to extract sensitive data including contents of password-protected or scheduled posts.

Key dates

02Disclosure timeline

March 12, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-2107 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2023-6798 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization CVE-2025-26944 WordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability CVE-2024-33919 WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability CVE-2024-35692 WordPress GDPR/CCPA Cookie Consent Banner plugin <= 3.2 - Broken Access Control vulnerability CVE-2026-24539 WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability