CVE-2024-53804 HIGH

CVE-2024-53804: WordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerability

Vendor Brandtoss

Product WP Mailster

Weakness CWE-201

Published December 6, 2024

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.

Explanation of Vulnerability in Simple Terms

02Summary

WP Mailster versions 1.8.16.0 and earlier expose sensitive information through improper access controls. An attacker can read data without authentication or user interaction. The vulnerability affects confidentiality but not integrity or availability. Update to a version newer than 1.8.16.0 to remediate.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the plugin without authentication.

Potential impact on your site

04Site Impact

Attackers can access confidential information stored or processed by WP Mailster.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 6, 2024 CVE published

April 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-53804 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html AskarLabs — CWE-201 write-up Insertion of Sensitive Information Into Sent Data

Related vulnerabilities