Vulnerability · Published Feb 28, 2024 · Assigned by Wordfence

CVE-2024-1476Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure

Medium 5.3

In plain English

A medium-severity improper access control in Under Construction / Maintenance Mode from Acurax from acurax. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages when maintenance mode is active thus bypassing the protection provided by the plugin.

Affected products (as reported)

Vendor	Product	Versions
acurax	Under Construction / Maintenance Mode from Acurax	0 – through 2.6

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References