Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-13773 is a high-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Uxper Civi. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-13773 is a sensitive information exposure vulnerability affecting the Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress in all versions up to and including 2.1.4. The issue stems from hard-coded credentials within the plugin, which exposes sensitive data such as LinkedIn client and secret keys. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 321 (Use of Hard-coded Cryptographic Key) and 798 (Use of Hard-coded Credentials).
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Successful exploitation allows extraction of the hard-coded credentials, including LinkedIn client and secret keys, potentially enabling unauthorized access to associated services or further compromise of integrated systems.
Advisories from Wordfence provide threat intelligence on the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/e3499182-7501-4fec-a7c6-b66ae47533cd?source=cve. The exposure originates in the plugin's source code at http://localhost:1337/wp-content/themes/civi/includes/class-init.php#L36.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54058
Vulnerability Data
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive…
more
data including LinkedIn client and secret keys.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring cryptographic keys to be established and managed according to defined requirements prevents developers from embedding static unchangeable keys.
Authenticator management requires secure distribution and handling of credentials, structurally discouraging hard-coded values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.AA-01's credential/key-management processes can reduce the incentive to embed secrets but do not address or detect hard-coded values in source code, so the weakness remains fully possible.
Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.
Data-in-transit protection similarly depends on non-hard-coded keys for encryption.
Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.
Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.
PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.