Lucene search

WordfenceVULNRICHMENT:CVE-2024-1473

HistoryMar 20, 2024 - 6:48 a.m.

CVE-2024-1473

2024-03-2006:48:24

Wordfence

github.com

cve-2024-1473

wordpress

plugin vulnerability

information exposure

rest api

unauthenticated attackers

bypassing maintenance mode

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mode protection provided by the plugin.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:colorlib:coming_soon_\\&_maintenance_mode:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "colorlib",
    "product": "coming_soon_\\&_maintenance_mode",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "1.0.99"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

wordpress.org/plugins/colorlib-coming-soon-maintenance/

www.wordfence.com/threat-intel/vulnerabilities/id/48dc10a9-7bb9-401f-befd-1bf620858825?source=cve

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-1473