CVE-2024-1476

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages when maintenance mode is active thus bypassing the protection provided by the plugin.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Feb 28, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-14775.3The Easy Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 vCVE-2024-14785.3The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via thCVE-2024-14795.3The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wCVE-2024-14807.5Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.CVE-2024-14815.3A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as commaCVE-2024-14826.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in publiCVE-2024-14837.5A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By craftinCVE-2024-14846.1The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date CVE-2024-14859.3A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricksCVE-2024-14867.4Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devicesCVE-2024-14875.4The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wiCVE-2024-14887.3A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbo
CVE-2024-1476: Medium severity, CVSS 5.3 | Vulnix