The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
{
"cna_assigner": "WPScan",
"unresolved_ranges": [
{
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"fixed": "4.5.26"
}
]
},
{
"source": "DESCRIPTION",
"extracted_events": [
{
"fixed": "4.5.26"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2834.json"
}{
"cpe": "cpe:2.3:a:helpful_project:helpful:*:*:*:*:*:wordpress:*:*",
"source": "CPE_RANGE",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "4.5.26"
}
]
}