CVE-2024-3682

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.

• CWE-200

• https://plugins.trac.wordpress.org/changeset/3076275/wp-staging
• https://wp-staging.com/wp-staging-changelog/
• https://wp-staging.com/wp-staging-pro-changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/75eab54b-dbe0-4440-b4ab-601c5041e180?source=cve
• https://plugins.trac.wordpress.org/changeset/3076275/wp-staging
• https://wp-staging.com/wp-staging-changelog/
• https://wp-staging.com/wp-staging-pro-changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/75eab54b-dbe0-4440-b4ab-601c5041e180?source=cve

Published

Apr 26, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36801A SQL injection vulnerability in SEMCMS v.4.8, allows a remo…5.9
• CVE-2024-36802Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-3681The Interactive World Maps plugin for WordPress is vulnerabl…6.1
• CVE-2024-36811Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-36814An arbitrary file read vulnerability in Adguard Home before …4.9
• CVE-2024-36819MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Script…5.4
• CVE-2024-36821Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.1…6.8
• CVE-2024-36823The encrypt() function of Ninja Core v7.0.0 was discovered t…7.5
• CVE-2024-36827An XML External Entity (XXE) vulnerability in the ebookmeta.…7.5
• CVE-2024-36829Incorrect access control in Teldat M1 v11.00.05.50.01 allows…7.5
• CVE-2024-36831A NULL pointer dereference in the plugins_call_handle_uri_cl…5.3
• CVE-2024-36832A NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_…7.5