CVE-2024-25591: 
WordPress vulnerability analysis and mitigation

A sensitive data exposure vulnerability was discovered in Benjamin Rojas WP Editor WordPress plugin affecting versions through 1.2.7. The vulnerability was identified on February 12, 2024, and was assigned CVE-2024-25591 (Patchstack).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It received a CVSS v3.1 base score of 7.5 (HIGH) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Patchstack assessed it with a score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability could allow a malicious actor to view sensitive information that is normally not available to regular users. This exposed information could potentially be used to exploit other weaknesses in the system (Patchstack).

The vulnerability requires no authentication to exploit, as indicated by the CVSS vector strings showing PR:N (Privileges Required: None) and UI:N (User Interaction: None) (NVD).

Users are advised to update to WP Editor version 1.2.8 or later to remediate this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).