PT-2024-3318 · WordPress · Wp Encryption

Krzysztof Zając · Published 2024-04-09 · Updated 2024-04-10 · CVE-2023-7046

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Encryption plugin for WordPress versions up to, and including, 7.0

Description The issue is related to insufficient protection of internal data, which can be exploited by a remote attacker to disclose protected information. Specifically, the vulnerability allows unauthenticated attackers to extract sensitive data, including TLS Certificate Private Keys, due to exposed Private key files.

Recommendations For WP Encryption plugin for WordPress versions up to, and including, 7.0, update to a version later than 7.0 to resolve the issue. As a temporary workaround, consider restricting access to the Private key files to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-03558

CVE-2023-7046

Affected Products

Wp Encryption

References · 9

• https://bdu.fstec.ru/vul/2024-03558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7046 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-letsencrypt-ssl/wp-encryption-one-click-free-ssl-certificate-ssl-https-redirect-to-force-https-ssl-score-70-sensitive-information-exposure-via-insufficiently-protected-files · Note
• https://t.me/cvenotify/76232 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1777796325993488611 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3066915%40wp-letsencrypt-ssl&new=3066915%40wp-letsencrypt-ssl&sfp_email=&sfph_mail= · Note
• https://vuldb.com/?id.260092 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7ab99751-24b7-41db-8a27-d86eda3eeee5?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3066915%40wp-letsencrypt-ssl&new=3066915%40wp-letsencrypt-ssl&sfp_email=&sfph_mail= · Note