PT-2024-33811 · WordPress · Wpupper Share Buttons

Krzysztof Zając · Published 2024-06-03 · Updated 2024-06-04 · CVE-2024-4997

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: WPUpper Share Buttons plugin for WordPress versions up to, and including, 3.43

Description: The issue allows unauthorized access to data when preparing sharing links for posts and pages, making it possible for unauthenticated attackers to obtain the contents of password protected posts and pages.

Recommendations: For versions up to, and including, 3.43, update to a version higher than 3.43 to resolve the issue. At the moment, there is no information about other mitigation measures.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-4997

Affected Products

Wpupper Share Buttons

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-4997 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3110227%40wpupper-share-buttons&new=3110227%40wpupper-share-buttons&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1797868686616690955 · Twitter Post
• https://t.me/cvenotify/81838 · Telegram Post
• https://wordpress.org/plugins/wpupper-share-buttons · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c68ec00c-20a5-461d-bf72-c3190d29c9cf?source=cve · Note