CVE-2024-10937

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.58 via the wp_ajax_nopriv_related_post_ajax_get_post_ids AJAX action. This makes it possible for unauthenticated attackers to extract sensitive data including titles of posts in draft status.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-109386.5The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execuCVE-2024-109394.8The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high priviCVE-2024-10947.3The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unCVE-2024-109405.3A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrarCVE-2024-109416.5A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affCVE-2024-109427.5The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89CVE-2024-109439.1An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and coCVE-2024-109448.4A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due CVE-2024-109457.3A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor tCVE-2024-109467.2A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster AutomatioCVE-2024-109477.2A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation ManCVE-2024-109486.5A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensiti