CVE-2024-0680

CVE-2024-0680 affects the WP Private Content Plus plugin for WordPress (versions up to and including 3.6). The root cause is improper access restriction of posts via the REST API when a page is private, allowing unauthenticated attackers to view protected posts. The vulnerability is documented ac...

CVE-2019-15816

The CVE-2019-15816 entry concerns the WordPress plugin wp-private-content-plus. Connected sources confirm that versions before 2.0 allow option changes via save_settings_page and other save_ functions without proper protection, enabling unauthenticated modification of plugin options. The vulnerab...

CVE-2021-4385

The CVE-2021-4385 issue affects the WordPress WP Private Content Plus plugin (versions up to 3.1). The root cause is missing or incorrect nonce validation in the save_groups() function, enabling Cross-Site Request Forgery that could allow unauthenticated attackers to add new group members by tric...