CVE-2024-2093 VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure
Unauthenticated attackers can view limited password-protected content via social meta tags in the VK All in One Expansion Unit WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2093?
CVE-2024-2093 is a medium-severity vulnerability in kurudrive VK All in One Expansion Unit, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags. This makes it possible for unauthenticated attackers to view limited password protected content.
Weakness: CWE-200
Which versions are affected by CVE-2024-2093?
It affects 1 product.
Products include Vektor-Inc Vk All in One Expansion Unit.
How do I fix CVE-2024-2093?
No fix has been published for CVE-2024-2093 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2093 being exploited?
There is no known exploitation of CVE-2024-2093 in the wild and no public exploit code.
Other vulnerabilities in kurudrive VK All in One Expansion Unit
- CVE-2024-37956 WordPress VK All in One Expansion Unit plugin <= 9.99.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-2170 VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className
- CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
- CVE-2023-27926 Cross-site scripting in VK All in One Expansion Unit
- CVE-2023-28367 Cross-site scripting in VK All in One Expansion Unit
Sources
Also known as GHSA-fj2v-p3c3-xxcr.