Bread
Monthly
Unauthenticated information disclosure in the Bread WordPress plugin (versions up to and including 2.9.12) lets any remote visitor read the plugin's entire configuration export, including the PDF protection password stored in plaintext, by simply requesting the /?export-meeting-list=1 endpoint. The flaw is trivially reachable: the download_settings function is registered on the plugins_loaded hook and explicitly permits execution on non-admin public pages, so no authentication, authorization, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U, base 5.3 MEDIUM). Impact is bounded to disclosure of the stored protection_password rather than site credentials or code execution, and no public exploit code has been identified at time of analysis; the practical risk depends on how sensitive the protected PDF meeting lists and their shared password are in a given deployment.
Unauthenticated information disclosure in the Bread WordPress plugin (versions up to and including 2.9.12) lets any remote visitor read the plugin's entire configuration export, including the PDF protection password stored in plaintext, by simply requesting the /?export-meeting-list=1 endpoint. The flaw is trivially reachable: the download_settings function is registered on the plugins_loaded hook and explicitly permits execution on non-admin public pages, so no authentication, authorization, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U, base 5.3 MEDIUM). Impact is bounded to disclosure of the stored protection_password rather than site credentials or code execution, and no public exploit code has been identified at time of analysis; the practical risk depends on how sensitive the protected PDF meeting lists and their shared password are in a given deployment.