CVE-2023-4242

Name of the Vulnerable Software and Affected Versions The FULL - Customer plugin for WordPress versions up to, and including, 2.2.3

Description The issue allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check via the "/health" REST route due to improper authorization.

Recommendations For versions up to, and including, 2.2.3, consider disabling access to the "/health" REST route until a patch is available to prevent exploitation. Restrict permissions for authenticated users to minimize the risk of sensitive information disclosure.