What’s Vulnerable › Vulnerabilities

CVE-2023-4917: Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-13 · updated 2026-06-17
• Weakness: CWE-200

Description

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.

Affected products

• VaultDweller Leyka: through 3.30.3

References

• https://plugins.trac.wordpress.org/browser/leyka/tags/3.30.3/inc/leyka-ajax.php#L393
• https://plugins.trac.wordpress.org/changeset/2990146/leyka
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd24b90-94ff-4625-8e3e-9c90e38683f9?source=cve
• https://plugins.trac.wordpress.org/browser/leyka/tags/3.30.3/inc/leyka-ajax.php#L393
• https://www.wordfence.com/threat-intel/vulnerabilities/id/dcd24b90-94ff-4625-8e3e-9c90e38683f9?source=cve

Get alerted when CVE-2023-4917 or the next vulnerability affects your stack