Icarry
Monthly
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.
Unauthenticated sensitive data exposure in the iCARRY WordPress plugin (versions <= 2.9) allows any remote, unauthenticated attacker to retrieve sensitive information by interacting with the plugin's endpoints over a standard HTTP connection. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and no special preconditions, making every unpatched site trivially accessible. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity means discovery and abuse would be straightforward for any motivated attacker.