CVE-2024-43257 MEDIUM

CVE-2024-43257: WordPress Leopard plugin <= 2.0.36 - Subscriber+ Sensitive Data Exposure vulnerability

Vendor Nouthemes
Product Leopard - WordPress offload media
Weakness CWE-200 · Info exposure
Published August 26, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Nouthemes Leopard - WordPress offload media.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.

Explanation of Vulnerability in Simple Terms

02Summary

The Leopard WordPress plugin for offloading media files exposes sensitive information to authenticated users. A logged-in user with low privileges can read data they should not have access to, such as configuration details or other users' media metadata. The vulnerability requires a valid WordPress account but no special interaction. Update to a version newer than 2.0.36.

What an attacker can do

03Attacker Capabilities

Read sensitive data like media metadata or configuration details they should not access.

Potential impact on your site

04Site Impact

Unauthorized users can view private media information or site configuration exposed by the plugin.

Conditions required to exploit

05Prerequisites

Attacker must have a valid WordPress user account with low privileges.

Key dates

06Disclosure timeline

August 26, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-12129 CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure CVE-2025-14726 Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints CVE-2026-8995 Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action CVE-2025-9987 Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure CVE-2025-13113 Web Accessibility by accessiBe <= 2.11 - Unauthenticated Sensitive Information Exposure