Lucene search

WordfenceCVE-2024-2931

HistoryApr 02, 2024 - 9:15 a.m.

CVE-2024-2931

2024-04-0209:15:07

Wordfence

web.nvd.nist.gov

cve-2024-2931

sensitive information exposure

wordpress

authenticated attackers

subscriber-level access

user email addresses

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract retrieve a list of all user email addresses who are registered on the site.

Affected configurations

Vulners

Node

syammohanmwpfront_user_role_editorRange≤3.2.1.11184wordpress

VendorProductVersionCPE
syammohanmwpfront_user_role_editor*cpe:2.3:a:syammohanm:wpfront_user_role_editor:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
syammohanm	wpfront_user_role_editor	*	cpe:2.3:a:syammohanm:wpfront_user_role_editor::::::wordpress::*

CNA Affected

[
  {
    "vendor": "syammohanm",
    "product": "WPFront User Role Editor",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "3.2.1.11184",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

inky-knuckle-2c2.notion.site/WPFront-User-Role-Editor-Information-disclosure-7435b8340a004f5f8485cad375326b2c

plugins.trac.wordpress.org/changeset/3061241/wpfront-user-role-editor/trunk/includes/users/class-assign-migrate.php

www.wordfence.com/threat-intel/vulnerabilities/id/078a0647-fc3a-436c-bf00-8776b16e66ff?source=cve

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2024-2931