EUVD-2026-92958
GHSA-45f6-r7hw-m3jq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Sitemovr ≤1.0.1
-
ExploitSend unauthenticated HTTP request to plugin endpoint
-
ImpactReceive and harvest exposed sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Exploitation requires only network access to a WordPress site running the Sitemovr plugin at version 1.0.1 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated, so default installs appear exposed. The primary limiting factor is deployment: the flaw only affects sites that have this specific, obscure plugin installed and not updated past 1.0.1. Note the advisory does not specify the exact exposed data or endpoint, so defenders cannot scope precisely what information is leaked without the vendor/Patchstack detail. |
| Impact | Signals are consistent but thin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, which maps cleanly to the 'Unauthenticated Sensitive Data Exposure' description and CWE-201 - so the 7.5 score is credible for a confidentiality-only issue (C:H/I:N/A:N). However, the decisive real-world signals are MISSING, not conflicting: no EPSS probability, no CISA KEV listing, and no public POC were provided, and no SSVC decision data was supplied. There is 'no public exploit identified at time of analysis.' The net effect is a genuinely remote, trivially triggerable disclosure bug, but confined to an obscure WordPress plugin, so despite the HIGH severity the practical priority is moderate and driven almost entirely by deployment footprint rather than by any evidence of exploitation. Treat the 7.5 as a theoretical-ease score, not an indicator of active threat. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Sitemovr 1.0.1 or earlier and receives sensitive information that the plugin discloses without access control. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, user interaction, or special timing is needed - a single request against a vulnerable install suffices. No public proof-of-concept was provided in the intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated sensitive data exposure in the Sitemovr WordPress plugin versions 1.0.1 and earlier allows remote attackers to retrieve undisclosed sensitive information from affected sites without authentication, user interaction, or non-default configuration, per the CVSS vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation is limited mainly by deployment: only WordPress sites that use this obscure plugin and have not updated past 1.0.1 are exposed, and the Patchstack advisory does not specify exactly which data or endpoint leaks. No public exploit code was identified at time of analysis, and the independent assessment rates the available signals as consistent but thin.
RemediationAI
No exact fixed version or vendor-released patch is specified in the provided data, so verify the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sitemovr/vulnerability/wordpress-sitemovr-plugin-1-0-1-sensitive-data-exposure-vulnerability?_s_id=cve for update guidance and upgrade to any version later than 1.0.1 if one is available. If no patched version exists, the most effective mitigation is to disable and remove the Sitemovr plugin, since eliminating an obscure plugin removes the exposure entirely (trade-off: loss of its site functionality). If removal is not possible, restrict access to the site and to Sitemovr-related endpoints using WAF or reverse-proxy rules, but note the advisory does not identify the exact leaking endpoint, so such rules may be incomplete and could block legitimate plugin requests. Additionally, monitor access logs for unauthenticated requests to Sitemovr plugin paths and review responses for unexpected sensitive data as a compensating detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin transmits sensitive information in a response or outbound data flow without adequate protection or authorization checks. The affected technology is the Sitemovr WordPress plugin, a PHP-based component running inside a WordPress installation; the CPE string cpe:2.3:a:dawer_drew:sitemovr:*:*:*:*:*:*:*:* identifies the Dawer Drew Sitemovr product, while the description scopes vulnerable versions to 1.0.1 and earlier. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, with high confidentiality impact but no integrity or availability impact. The advisory does not disclose the exact endpoint, parameter, or sensitive field involved, so the precise sink cannot be confirmed from the provided data.
Know when Sitemovr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable disclosure (AV:N/PR:N/UI:N) per description; confidentiality-only impact (C:H, I:N, A:N) consistent with CWE-201.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
Executive ViewAI
The Sitemovr WordPress plugin (versions 1.0.1 and earlier) contains an unauthenticated sensitive data exposure vulnerability (CVE-2026-41563) that could allow remote attackers to retrieve confidential information from affected websites. Organizations using this plugin face potential data leakage that may violate privacy regulations or expose proprietary content, though exploitation is currently limited by the plugin's niche adoption and the absence of public exploit code. Leadership should prioritize identifying and mitigating affected WordPress instances to prevent potential reputational and compliance damage.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the Sitemovr plugin (versions 1.0.1 and earlier) where possible, implementing WAF rules to block unauthenticated access to plugin endpoints, monitoring web server and application logs for suspicious data access patterns, and restricting network access to affected WordPress sites.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB