CVE-2024-56300
Published: 07 January 2025
Summary
CVE-2024-56300 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters sensitive information from plugin outputs prior to transmission, directly preventing insertion and retrieval of embedded sensitive data by unauthenticated attackers.
Restricts sensitive information in publicly accessible content generated by the WordPress plugin, mitigating exposure through unauthenticated network access.
Requires identification and timely remediation of the specific flaw in the plugin, patching versions through 2.0.0 to eliminate sensitive data leakage.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability is an unauthenticated information disclosure in a public-facing WordPress plugin, directly enabling exploitation of the web application (T1190) to retrieve sensitive data from the local system (T1005).
NVD Description
Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.0.
Deeper analysisAI
CVE-2024-56300 is an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201) in the WordPress plugin Post/Page Copying Tool, also known as postpage-import-export-with-custom-fields-taxonomies. This issue affects all versions of the plugin from n/a through 2.0.0. The vulnerability enables the retrieval of embedded sensitive data and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to the potential for significant confidentiality impact.
An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and without requiring user interaction. Exploitation allows the attacker to retrieve sensitive information embedded in data sent by the plugin, potentially exposing confidential details from WordPress sites running the affected plugin.
The Patchstack advisory provides further details on this vulnerability, including vulnerability-specific information for the Post/Page Copying Tool plugin version 2.0.0: https://patchstack.com/database/Wordpress/Plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-plugin-2-0-0-sensitive-data-exposure-vulnerability?_s_id=cve.
Details
- CWE(s)