CVE-2024-12103: 
WordPress vulnerability analysis and mitigation

The Content No Cache WordPress plugin (versions up to 0.1.2) contains an Information Exposure vulnerability (CVE-2024-12103) that was discovered and disclosed on December 23, 2024. The vulnerability affects the plugin's eosdynget_content action functionality and allows unauthenticated attackers to access restricted content (NVD CVE).

The vulnerability stems from insufficient restrictions on which posts can be included via the eosdynget_content action. It has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness has been classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (Wordfence Intel).

The vulnerability allows unauthenticated attackers to extract data from password-protected, private, or draft posts that they should not have access to. This represents a significant information disclosure risk for sites using the affected plugin versions (NVD CVE).

A fix has been implemented in the plugin's source code as evidenced by the WordPress plugin repository changes (WordPress Plugin Changes). Users should update to versions newer than 0.1.2 when available.