PT-2024-3150 · WordPress · Blog2Social

Krzysztof Zając · Published 2024-04-11 · Updated 2025-06-05 · CVE-2024-3678

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress versions up to, and including, 7.4.2

Description The issue is related to insufficient protection of sensitive data, allowing unauthenticated attackers to view limited information from password-protected posts. This can enable remote attackers to gain unauthorized access to protected information.

Recommendations For versions up to, and including, 7.4.2, update to a version later than 7.4.2 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Fix

Missing Authorization

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-862

CWE-200

CWE-922

Related Identifiers

BDU:2024-03363

CVE-2024-3678

Affected Products

Blog2Social

References · 10

• https://plugins.trac.wordpress.org/changeset/3074883/blog2social/trunk/includes/Meta.php · Patch
• https://osv.dev/vulnerability/CVE-2024-3678 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3069574/blog2social/trunk/includes/Meta.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-3678 · Security Note
• https://bdu.fstec.ru/vul/2024-03363 · Security Note
• https://vuldb.com/ru/?id.262049 · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blog2social/blog2social-social-media-auto-post-scheduler-742-information-exposure · Note
• https://t.me/cvenotify/124819 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2dea1bcb-14c2-4ec9-8a4d-087bac2db486?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1783814063799099868 · Twitter Post