CVE-2023-4686CWE-862

WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure

Medium · published November 22, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-11-22T15:33Z
EPSS history
Timeline
  • 22 NOV 15:33Z
    WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure
    cvelistv5