CVE-2024-43258: 
WordPress vulnerability analysis and mitigation

A sensitive information exposure vulnerability was identified in Store Locator Plus WordPress plugin, tracked as CVE-2024-43258. The vulnerability affects all versions of Store Locator Plus through version 2311.17.01. This security issue was discovered by researcher Peng Zhou and was publicly disclosed on August 12, 2024 (Patchstack).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while Patchstack assigned a CVSS score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is exploitable remotely and requires no authentication or user interaction (NVD).

This vulnerability could allow malicious actors to access sensitive information that is normally restricted from regular users. The exposed information could potentially be leveraged to exploit other weaknesses in the system (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. The issue affects versions up to and including 2311.17.01 (Patchstack).