PT-2024-36725 · WordPress · Open Graph Plugin

Krzysztof Zając · Published 2024-06-05 · Updated 2024-06-11 · CVE-2024-5615

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Graph plugin for WordPress versions prior to 1.11.3

Description The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure via the opengraph default description function. This makes it possible for unauthenticated attackers to extract sensitive data, including partial content of password-protected blog posts.

Recommendations For versions up to and including 1.11.2, update to a version later than 1.11.2 to resolve the issue. As a temporary workaround, consider disabling the opengraph default description function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-5615

Affected Products

Open Graph Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2024-5615 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3097574 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-5615 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f57dc0fe-07f3-457e-8080-fe530f6a9f01?source=cve · Note
• https://plugins.trac.wordpress.org/browser/opengraph/trunk/opengraph.php#L369 · Note
• https://t.me/cvenotify/82868 · Telegram Post
• https://twitter.com/CVEnew/status/1798560751403061500 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1798592496915611970 · Twitter Post