OpenInviter for WordPress <= 1.7.0 - Sensitive Information Disclosure
Strategic Overview
Vulnerability Overview
The OpenInviter for WordPress plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.7.0 via the log_error file. This can allow unauthenticated attackers to extract sensitive data from site visitors including emails and passwords (in clear text) for providers such as Yahoo, Gmail, Hotmail, AOL and others.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-532 (Insertion of Sensitive Information into Log File) The product writes sensitive information to a log file.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C