CVE-2024-3235CWE-862

Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure

Medium · published April 10, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

The Essential Grid Gallery WordPress Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the on_front_ajax_action() function. This makes it possible for unauthenticated attackers to view private and password protected posts that may have private or sensitive information.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00688 · 52.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-04-10T04:30Z
EPSS history
Timeline
  • 10 APR 04:30Z
    Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure
    cvelistv5