CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
Explanation of Vulnerability in Simple Terms
The GetResponse Email Marketing for WordPress plugin versions 1.5.3 and earlier expose sensitive data to authenticated users. A logged-in user with low privileges can read information they should not have access to, such as API keys or configuration details. The vulnerability requires a valid WordPress account but no additional user interaction. Update to a version newer than 1.5.3.
What an attacker can do
Read sensitive data like API keys or configuration details that should be restricted.
Potential impact on your site
Authenticated users can access confidential plugin settings or API credentials, risking account compromise.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
