CVE-2023-4242
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to and including 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration.
Risk Assessment
The organization may be exposed to the disclosure of sensitive site configuration information, potentially leading to further attacks or security breaches.
Recommendation
It is recommended to update the FULL - Customer plugin to the latest version to mitigate this vulnerability and review user permissions in the system.
Original NVD description (English source)
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.