CVE-2024-2950: 
WordPress vulnerability analysis and mitigation

The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress contains an Information Exposure vulnerability (CVE-2024-2950) affecting all versions up to and including 1.6.14. The vulnerability was discovered and disclosed on April 6, 2024 (NVD, ASEC).

The vulnerability exists in the meta information handling (og:description) of the plugin. When exploited, it allows unauthenticated attackers to view the first 130 characters of password-protected posts that may contain sensitive information. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability enables unauthorized access to potentially sensitive information contained within the first 130 characters of password-protected posts. This information disclosure could lead to the exposure of confidential data that was intended to be protected behind password authentication (Wordfence).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack vector is network-accessible and has low attack complexity (NVD).

Users are advised to update to version 1.6.15 of the BoldGrid Easy SEO plugin, which contains the security fix for this vulnerability (ASEC).