What’s Vulnerable › Vulnerabilities

CVE-2024-11094: 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-16 · updated 2026-06-17
• Weakness: CWE-488

Description

The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract data such as redirects including GET parameters which may reveal sensitive information. On most sites this is unlikely to be the case.

Affected products

• aaron13100 404 Solution: through 2.35.17

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3188844%40404-solution%2Ftrunk&old=3169186%40404-solution%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d738be73-2573-4fb8-b6f0-768a08628265?source=cve

Get alerted when CVE-2024-11094 or the next vulnerability affects your stack