Sermon E
Monthly
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated attackers can reach functionality in the WordPress plugin Sermon'e (vendor beplusthemes) at version 1.0.2 and earlier that performs no authorization check, exposing data the plugin is meant to protect. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning it is remotely reachable with no credentials and no user interaction, and it affects confidentiality only while leaving integrity and availability intact; exploitation requires only that the plugin be installed and active. There is no public exploit identified at time of analysis and the plugin is not listed in CISA KEV, so the practical risk is driven by deployment scope rather than by active exploitation; the specific vulnerable endpoint is not described in the available data and should be confirmed from the Patchstack advisory.