CVE-2021-24997CWE-862

WP Guppy < 1.3 - Sensitive Information Disclosure

published December 27, 2021

CVSS
—
EPSS
3%
Percentile
86.4
In the wild
Unconfirmed
What it is

The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02797 · 86.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2021-12-27T10:33Z
EPSS history
Timeline
  • 27 DEC 10:33Z
    WP Guppy < 1.3 - Sensitive Information Disclosure
    cvelistv5