CVE-2020-35934

MEDIUM

Advanced Access Manager < 6.6.2 - Unauthorized Sensitive Information Exposure via REST API Authentication

Title source: llm
STIX 2.1

Description

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).

References (1)

Core 1

Scores

CVSS v3 4.3
EPSS 0.0106
EPSS Percentile 60.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
vasyltech/advanced_access_manager < 6.6.2
Published Jan 01, 2021
Tracked Since Feb 18, 2026