Infinite Uploads
Monthly
Sensitive data exposure in ClikIT's Infinite Uploads WordPress plugin (all versions through 3.4.1) lets an attacker who already holds a low-privileged account on the site cause embedded secrets to be returned in outbound responses. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable with low complexity and no user interaction, but the PR:L metric means an authenticated session is a hard prerequisite - anonymous visitors cannot trigger it - so confidentiality is fully impacted while integrity and availability are untouched. Severity is moderate (CVSS 6.5); there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and the exact endpoint or feature that emits the sensitive data is not disclosed in the available advisory.
Sensitive data exposure in ClikIT's Infinite Uploads WordPress plugin (all versions through 3.4.1) lets an attacker who already holds a low-privileged account on the site cause embedded secrets to be returned in outbound responses. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable with low complexity and no user interaction, but the PR:L metric means an authenticated session is a hard prerequisite - anonymous visitors cannot trigger it - so confidentiality is fully impacted while integrity and availability are untouched. Severity is moderate (CVSS 6.5); there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and the exact endpoint or feature that emits the sensitive data is not disclosed in the available advisory.