Notivo
Monthly
Unauthenticated sensitive data exposure in the Notivo WordPress plugin (woo-notification) through version 1.4.2 allows remote attackers to retrieve limited confidential information from affected sites without authentication or user interaction. The CVSS vector (PR:N/UI:N) confirms the issue is remotely exploitable on a default installation, but impact is confined to low confidentiality (C:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the plugin's narrow deployment footprint limits exposure relative to core WordPress.
Unauthenticated sensitive data exposure in the Notivo WordPress plugin (woo-notification) through version 1.4.2 allows remote attackers to retrieve limited confidential information from affected sites without authentication or user interaction. The CVSS vector (PR:N/UI:N) confirms the issue is remotely exploitable on a default installation, but impact is confined to low confidentiality (C:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the plugin's narrow deployment footprint limits exposure relative to core WordPress.