CVE-2024-43258: 
WordPress vulnerability analysis and mitigation

A sensitive information exposure vulnerability was identified in Store Locator Plus WordPress plugin, tracked as CVE-2024-43258. The vulnerability affects all versions of Store Locator Plus through version 2311.17.01. This security issue was discovered by researcher Peng Zhou and was publicly disclosed on August 12, 2024 (Patchstack).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Patchstack assigned a CVSS score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is exploitable remotely and requires no authentication or user interaction (NVD).

This vulnerability could allow malicious actors to access sensitive information that is normally restricted from regular users. The exposed information could potentially be leveraged to exploit other weaknesses in the system (Patchstack).

The vulnerability is classified as unauthenticated, meaning it can be exploited without requiring any form of authentication. Patchstack has assessed this as having a low priority impact and considers it unlikely to be exploited (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. The issue affects versions up to and including 2311.17.01 (Patchstack).