Simple History Plugin < 2.7.5 - Sensitive Information Disclosure
2016-07-28 00:00
AnonymousStrategic Overview
StatusPatched in 2.7.5
Affected PluginSimple History – Track, Log, and Audit WordPress Changes
Affected Version
<= 2.7.4CVSS4.3Medium
CVE
N/AVulnerability Overview
The Simple History plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.7.4 via the ajax_simple_history_filters_search_user function. This can allow authenticated attackers to extract sensitive data including logged in usernames and their email address.
Technical Analysis
REMEDIATION: Update to version 2.7.5, or a newer patched version --- IDENTIFIER: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C