7.5

CVE-2024-2107

Blossom Spa <= 1.3.3 - Sensitive Information Exposure

Blossom Spa <= 1.3.3 - Sensitive Information Exposure

The Blossom Spa theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.3 via generated source. This makes it possible for unauthenticated attackers to extract sensitive data including contents of password-protected or scheduled posts.
Mögliche Gegenmaßnahme
Blossom Spa: Update to version 1.3.4, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Blossomthemes ≫ Blossom Spa SwPlatformwordpress Version < 1.3.4
Weitere Schwachstelleninformationen
SystemWordPress Theme
≫
Produkt Blossom Spa
Version *-1.3.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.372
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
security@wordfence.com 5.8 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=220138%40blossom-spa&new=220138%40blossom-spa&sfp_email=&sfph_mail=
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/5e54dbf9-a5d1-413d-96ac-93dd499c21a4?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/5e54dbf9-a5d1-413d-96ac-93dd499c21a4
Third Party Advisory