// For flags

CVE-2024-0872

Watu Quiz <= 3.4.1 - Sensitive Information Disclosure

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user meta data which can include session tokens and user emails.

El complemento Watu Quiz para WordPress es vulnerable a la exposición de información confidencial en todas las versiones hasta la 3.4.1 incluida a través del código corto watu-userinfo. Esto hace posible que los atacantes autenticados, con acceso de nivel de colaborador y superior, extraigan metadatos confidenciales de los usuarios que pueden incluir tokens de sesión y correos electrónicos de los usuarios.

*Credits: Lucio Sá
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-01-24 CVE Reserved
  • 2024-04-04 CVE Published
  • 2024-04-10 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Prasunsen
Search vendor "Prasunsen"
 Watu Quiz
Search vendor "Prasunsen" for product "Watu Quiz"
 <= 3.4.1
Search vendor "Prasunsen" for product "Watu Quiz" and version " <= 3.4.1"
en
Affected