CVE-2024-33575: 
WordPress vulnerability analysis and mitigation

The User Meta – User Profile Builder and User management plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-33575) affecting all versions up to and including 3.0. The vulnerability was discovered by researcher stealthcopter and publicly disclosed on April 25, 2024. The issue has been assigned a CVSS v3.1 score of 5.3 (Medium) (Patchstack).

The vulnerability exists in the /views/debug.php file of the User Meta plugin. It allows unauthenticated attackers to extract sensitive configuration data from the system. The issue has been classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) with a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (WPScan).

This vulnerability could allow malicious actors to view sensitive information that is normally not accessible to regular users. The exposed information could potentially be used to exploit other weaknesses in the system (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Patchstack).

The vulnerability has been fixed in version 3.1 of the User Meta plugin. Users are advised to update to version 3.1 or later to remove the vulnerability. The security issue has been assessed as having a low severity impact (Patchstack).