CVE-2024-12560: 
WordPress vulnerability analysis and mitigation

The Button Block WordPress plugin (versions up to 1.1.5) contains a Sensitive Information Exposure vulnerability (CVE-2024-12560). The vulnerability exists in the 'btnblockduplicate_post' function, which allows authenticated attackers with Contributor-level access or higher to extract sensitive data from draft, scheduled, private, and password-protected posts (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N by NVD, while Wordfence assigned a score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level privileges or higher to access sensitive information from various types of protected posts, including drafts, scheduled posts, private posts, and password-protected content (NVD).

A patch has been released to address this vulnerability. Users are advised to update their Button Block plugin to a version newer than 1.1.5 (WordPress Plugin).