CVE-2024-2093

MEDIUM

VK All in One Expansion Unit - Info Disclosure

Title source: llm

Description

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags. This makes it possible for unauthenticated attackers to view limited password protected content.

References (3)

Core 3

Core References

Issue Tracking, Vendor Advisory

https://github.com/vektor-inc/vk-all-in-one-expansion-unit/pull/1072

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050823%40vk-all-in-one-expansion-unit&new=3050823%40vk-all-in-one-expansion-unit&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/ea2b5dca-42a5-49d4-800d-b268572968a9?source=cve

Scores

CVSS v3 6.5

EPSS 0.0068

EPSS Percentile 47.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

kurudrive/VK All in One Expansion Unit < 9.95.0.1

vektor-inc/vk_all_in_one_expansion_unit < 9.96.0.0

Published Apr 09, 2024

Tracked Since Feb 18, 2026