What is this Sensitive Information Exposure vulnerability?

this Sensitive Information Exposure vulnerability is tracked as a Sensitive Information Exposure issue affecting the Plugin EWWW Image Optimizer.

Which EWWW Image Optimizer versions are affected?

The primary affected range is Versions before 7.2.1.

How should operators remediate this Sensitive Information Exposure vulnerability?

Update to 7.2.1 or newer where that release is compatible with the site.

Vulnerability Report

Plugin Medium Patch path listed

EWWW Image Optimizer <= 7.2.0 - Sensitive Information Exposure

The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file permissions and various plugin settings.

Quick Answer

This vulnerability is a medium severity with CVSS 5.3 Sensitive Information Exposure issue affecting the Plugin EWWW Image Optimizer. It affects Versions before 7.2.1 and is fixed in 7.2.1.

Back to Feed View Plugin Hub

Published

Sep 08, 2023

Last Updated

Jan 22, 2024

Slug

ewww-image-optimizer

Risk Profile

5.3 CVSS Score

Weakness

Exposure of Sensitive Information to an Unauthorized Actor

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Researchers

No researcher credits supplied.

Operational Summary

What the operator needs to know

Share Email

Patch Status

Patched release is available

Remediation

Update to version 7.2.1, or a newer patched version

Operator Briefing

the tracked vulnerability is tracked for the Plugin EWWW Image Optimizer as medium severity with CVSS 5.3. The affected range is Versions before 7.2.1. Update EWWW Image Optimizer to 7.2.1 or newer where that version is compatible with the site.

Issue Type

Sensitive Information Exposure

Primary Fixed Version

7.2.1

Primary Affected Range

Versions before 7.2.1

Tracking ID

d7d08bfd-9861-4e21-a696-25b00233ad94

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d08bfd-9861-4e21-a696-25b00233ad94?source=api-prod

Detailed Metadata

Software Type	Plugin
Software Slug	ewww-image-optimizer View on wordpress.org
CVE	No linked CVE entry.
Patched Versions	7.2.1
Affected Versions	Versions before 7.2.1

Related CVE Cluster

Related CVEs for EWWW Image Optimizer

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2016-20010 2.8.5 Jun 08, 2016

CVE-2016-20010 EWWW Image Optimizer Remote Code Execution

EWWW Image Optimizer <= 2.8.4 - Remote Code Execution

Medium CVE-2014-6243 2.0.2 Oct 09, 2014

CVE-2014-6243 EWWW Image Optimizer Cross-Site Scripting

EWWW Image Optimizer <= 2.0.1 - Reflected Cross-Site Scripting

Medium CVE-2023-40600 7.2.1 Nov 14, 2023

CVE-2023-40600 EWWW Image Optimizer Sensitive Information Exposure

EWWW Image Optimizer <= 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log

Medium CVE-2024-31924 7.3.0 Apr 10, 2024

CVE-2024-31924 EWWW Image Optimizer Cross-Site Request Forgery

EWWW Image Optimizer <= 7.2.3 - Cross-Site Request Forgery

Medium CVE-2020-36750 5.9 Sep 06, 2020

CVE-2020-36750 EWWW Image Optimizer Cross-Site Request Forgery

EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass

Licensing Notices

This record contains material that is subject to copyright

DEFIANT

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more