CVE-2024-2931 WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure
Authenticated subscribers can extract all registered user email addresses via an AJAX action in the WPFront User Role Editor plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2931?
CVE-2024-2931 is a medium-severity vulnerability in syammohanm WPFront User Role Editor, published on 2 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WPFront User Role Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.1.11184 via the wpfront_user_role_editor_assign_roles_user_autocomplete AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract retrieve a list of all user email addresses who are registered on the site.
Weakness: CWE-200
Which versions are affected by CVE-2024-2931?
It affects 1 product.
Products include Wpfront Wpfront User Role Editor.
How do I fix CVE-2024-2931?
No fix has been published for CVE-2024-2931 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2931 being exploited?
There is no known exploitation of CVE-2024-2931 in the wild and no public exploit code.
Other vulnerabilities in syammohanm WPFront User Role Editor
Sources
Also known as GHSA-229f-m84c-q777.