CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks.
Explanation of Vulnerability in Simple Terms
The HubSpot All-In-One Marketing plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read sensitive information they should not access. An attacker with a standard user account can view data restricted to higher-privilege roles. The vulnerability affects versions up to 11.3.32 and requires a valid login to exploit.
What an attacker can do
Read sensitive data restricted to higher-privilege users by making authenticated requests.
Potential impact on your site
Unauthorized disclosure of sensitive information to standard users; data confidentiality breach.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
