CVE-2014-5337

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-08-29 · updated 2026-06-17
Weakness: CWE-264

Description

The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.

Affected products

Wordpress Mobile Pack Project Wordpress Mobile Pack: through 2.0.1; 1.2.0, 1.2.0-b, 1.2.0-b2
WPMobilePack.com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps: 1.0.8223, 1.1.1, 1.1.2, 1.1.3, 1.1.9, 1.1.91 (+6)

References

http://secunia.com/advisories/60584
http://wordpress.org/plugins/wordpress-mobile-pack/changelog/
http://www.securityfocus.com/bid/69292
https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts/
http://secunia.com/advisories/60584
http://wordpress.org/plugins/wordpress-mobile-pack/changelog/
http://www.securityfocus.com/bid/69292
https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts/

Get alerted when CVE-2014-5337 or the next vulnerability affects your stack