OpenInviter for WordPress <= 1.7.0 - Sensitive Information Disclosure
Strategic Overview
- Status
- Unpatched
- Affected Plugin
- OpenInviter for WordPress
- Affected Version
<= 1.7.0- CVSS
- 7.5High
- Weakness type
- CWE-532 · Insertion of Sensitive Information into Log File
- CVE
CVE pending
At a glance
This record tracks a high-severity Insertion of Sensitive Information into Log File vulnerability in the OpenInviter for WordPress WordPress plugin, affecting versions <= 1.7.0. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. No fixed release has been reported yet; treat installations running this software as exposed. Disclosed January 2013, reported by Ryuzaki Lawlet.
Vulnerability Overview
The OpenInviter for WordPress plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.7.0 via the log_error file. This can allow unauthenticated attackers to extract sensitive data from site visitors including emails and passwords (in clear text) for providers such as Yahoo, Gmail, Hotmail, AOL and others.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
Remediation
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
How does WordSec protect against this?
No patched version is recorded yet, so there is nothing to update to; WordSec's vulnerability alerts flag this record the moment that changes.
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C