CVE-2024-1472: 
WordPress vulnerability analysis and mitigation

The WP Maintenance plugin for WordPress contains an Information Exposure vulnerability (CVE-2024-1472) affecting all versions up to and including 6.1.6. The vulnerability was discovered and disclosed on February 28, 2024. This security issue affects the WordPress plugin's REST API implementation (NVD).

The vulnerability exists in the REST API implementation of the WP Maintenance plugin, where unauthenticated attackers can bypass the plugin's maintenance mode to obtain post and page content via REST API. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) (NVD).

When exploited, this vulnerability allows unauthenticated attackers to bypass the plugin's maintenance mode and access post and page content through the REST API, potentially exposing sensitive or restricted information that should be hidden during maintenance mode (NVD).

The vulnerability can be exploited by unauthenticated attackers remotely through the REST API, requiring no special privileges or user interaction. The attack complexity is considered Low, making it relatively straightforward to exploit (NVD).

Users should update their WP Maintenance plugin to a version newer than 6.1.6 which contains the security fix. The vulnerability has been addressed in the plugin's repository (WordPress Plugin).