CVE-2024-38761 HIGH

CVE-2024-38761: WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability

Vendor Dylan James
Product Zephyr Project Manager
Weakness CWE-200 · Info exposure
Published August 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.99.

Explanation of Vulnerability in Simple Terms

02Summary

Zephyr Project Manager versions up to 3.3.99 expose sensitive information to unauthenticated attackers over the network. The vulnerability allows direct access to confidential data without requiring authentication or user interaction. No integrity or availability impact has been reported. Organizations using affected versions should update immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the application without authentication.

Potential impact on your site

04Site Impact

Confidential data stored in Zephyr Project Manager is accessible to anyone on the network.

Conditions required to exploit

05Prerequisites

Network access to the application; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-7526 PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page CVE-2026-21626 Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla CVE-2025-13371 Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure CVE-2025-12074 Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure CVE-2026-0950 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data