CVE-2024-32953 HIGH

CVE-2024-32953: WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability

Product Newsletters
Weakness CWE-532 · Sensitive info in logs
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information into Log File vulnerability in Newsletters.This issue affects Newsletters: from n/a through 4.9.5.

Explanation of Vulnerability in Simple Terms

02Summary

Newsletters version 4.9.5 and earlier exposes sensitive information through improper access controls. An attacker on the network can read confidential data without authentication or user interaction. The vulnerability affects the Newsletters product and may impact sites using this component for email management.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the Newsletters component without logging in.

Potential impact on your site

04Site Impact

Confidential data stored in Newsletters may be exposed to unauthenticated attackers.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-10486 Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File CVE-2023-51408 WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure CVE-2025-9985 Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File CVE-2024-32686 WordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerability CVE-2023-52143 WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data Exposure