CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco_submit_post' AJAX endpoint. This makes it possible for unauthenticated attackers to extract content from posts that has been protected by the plugin.
Explanation of Vulnerability in Simple Terms
Locker Content versions 1.0.0 and earlier expose sensitive information over the network without authentication. An attacker can read confidential data by sending network requests to the affected application. No user interaction or special privileges are required. Update to a version newer than 1.0.0 to resolve this issue.
What an attacker can do
Read sensitive information from the application without authentication.
Potential impact on your site
Confidential data may be exposed to unauthenticated attackers over the network.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
