CVE-2026-24589
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-01-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cargus | cargus_plugin | to 1.5.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the WordPress Cargus Plugin (up to version 1.5.8) allows unauthenticated attackers to retrieve sensitive information that should normally be restricted. It is classified as a Sensitive Data Exposure issue, meaning sensitive data is inserted into sent data and can be accessed improperly. The vulnerability requires no user privileges to exploit and falls under the OWASP Top 10 category A3: Sensitive Data Exposure. [1]
How can this vulnerability impact me? :
The impact of this vulnerability is that sensitive information can be exposed to unauthorized users, potentially leading to further exploitation of system weaknesses. Although the severity is considered low with a CVSS score of 5.3 and it is unlikely to be widely exploited, the exposure of sensitive data could still compromise confidentiality and security of the affected system. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available for this vulnerability, immediate mitigation steps include using security services such as those offered by Patchstack to help protect your system. Additionally, monitor access to the Cargus plugin and restrict unauthenticated access where possible to reduce exposure to sensitive data. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves exposure of sensitive data, which could impact compliance with standards and regulations such as GDPR and HIPAA that require protection of sensitive information. However, the provided resources do not explicitly discuss compliance implications or regulatory impact. [1]