CVE-2024-35690 - CVE House

Status published Medium CVE-2024-35690

WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability

6.5 CVSS

Vulnerability Description

Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35690

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Dave Jong | Patchstack

References

https://patchstack.com/database/wordpress/plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-0-1-subscriber-user-meta-data-exposure-vulnerability?_s_id=cve

More from MarketingFire

View All →

CVE-2023-36520

WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)

Medium 5.4

Affected Vendor

MarketingFire

View all reports →

Affected Software

Widget Options

Vulnerable Versions:

Unknown

Timeline

Official Publish: June 17th, 2026

Last Modified: June 17th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-201

MITRE ATT&CK TTPs

T1041 Exfiltration Over C2 Channel

Exfiltration

T1040 Network Sniffing

Credential Access

T1557 Adversary-in-the-Middle

Collection

T1552 Unsecured Credentials