Description
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Loops & Logic | < 4.3.0 | 4.3.0 |
References
- https://wpscan.com/vulnerability/70344f9a-065d-4611-b958-0297af6f2c63/ exploit vdb-entry technical-description