CVE-2024-0368
Assigner: Wordfence
Published: 2024-03-13T15:27:21.681Z
State: PUBLISHED
affected: vendor: wpmudev
product: Hustle – Email Marketing, Lead Generation, Optins, Popups
versions: version: *
status: affected
lessThanOrEqual: 7.8.3
versionType: semver
defaultStatus: unaffected
descriptions: value: The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extract sensitive data including PII.
problemTypes: descriptions: description: CWE-522 Insufficiently Protected Credentials
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
baseScore: 8.6
baseSeverity: HIGH
credits: type: finder
value: Sean Murphy
timeline: time: 2024-03-12T00:00:00.000+00:00
value: Disclosed