CVE-2024-0906

Name of the Vulnerable Software and Affected Versions f(x) Private Site plugin for WordPress versions up to, and including, 1.2.1

Description The issue allows unauthenticated attackers to obtain page and post contents of a site protected with the f(x) Private Site plugin via the API.

Recommendations For versions up to, and including, 1.2.1, update to a version later than 1.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the API until a patch is available.