vulnerability

WordPress Plugin: wp-private-content-plus: CVE-2024-0680: Protection Mechanism Failure

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:N/A:N)

Published

Feb 27, 2024

Added

May 15, 2025

Modified

Apr 29, 2026

Description

The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts.

Solution

wp-private-content-plus-plugin-cve-2024-0680

References

https://www.cve.org/CVERecord?id=CVE-2024-0680
https://www.wordfence.com/threat-intel/vulnerabilities/id/43d8904f-3bc9-4c67-b44b-8d78762b6b30?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16471
CVE-2024-0680
https://attackerkb.com/topics/CVE-2024-0680
CWE-693
EUVD-EUVD-2024-16471

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report