CVE-2024-32716 MEDIUM

CVE-2024-32716: WordPress StreamWeasels Twitch Integration plugin <= 1.7.8 - API Sensitive Data Exposure vulnerability

Vendor Streamweasels
Product StreamWeasels Twitch Integration
Weakness CWE-200 · Info exposure
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StreamWeasels StreamWeasels Twitch Integration.This issue affects StreamWeasels Twitch Integration: from n/a through 1.7.8.

Explanation of Vulnerability in Simple Terms

02Summary

StreamWeasels Twitch Integration versions 1.7.8 and earlier expose sensitive information over the network without requiring authentication. An attacker can read data that should be restricted, such as API tokens or user credentials, by making direct requests to the application. Update to a version newer than 1.7.8 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive data like API tokens or user information without logging in.

Potential impact on your site

04Site Impact

Exposed API tokens or user data could be used to compromise Twitch integration or user accounts.

Conditions required to exploit

05Prerequisites

Network access to the application; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6728 Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream' CVE-2026-7526 PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page CVE-2026-2128 Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie CVE-2026-3594 Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint CVE-2025-13973 StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure