CVE-2024-22301 Overview
CVE-2024-22301 is a sensitive information disclosure vulnerability in the Ignazio Scimone Albo Pretorio On line WordPress plugin, developed by Eduva. The flaw affects all versions of the albo-pretorio-on-line plugin up to and including 4.6.6. An unauthenticated remote attacker can access sensitive information that should be restricted to authorized users.
The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and [CWE-276] (Incorrect Default Permissions). The plugin is widely deployed by Italian public administrations to publish the official online notice board (Albo Pretorio).
Critical Impact
An unauthenticated network attacker can retrieve confidential data from affected Albo Pretorio On line WordPress installations without user interaction.
Affected Products
- Eduva Albo Pretorio On line WordPress plugin versions through 4.6.6
- WordPress sites running the albo-pretorio-on-line plugin
- Italian public administration portals using vulnerable plugin builds
Discovery Timeline
- 2024-01-24 - CVE-2024-22301 published to NVD
- 2026-04-28 - Last updated in NVD database
Technical Details for CVE-2024-22301
Vulnerability Analysis
The vulnerability resides in the Albo Pretorio On line WordPress plugin, which manages public notice publication for Italian municipal entities. The plugin exposes sensitive information to unauthorized actors over the network. Attackers do not need credentials or user interaction to trigger the disclosure.
The issue impacts confidentiality without affecting integrity or availability. The Patchstack advisory categorizes the weakness as a sensitive data exposure flaw. Documents and metadata that should remain restricted become reachable through the plugin's exposed endpoints.
Root Cause
The root cause maps to [CWE-276] Incorrect Default Permissions combined with [CWE-200] Information Exposure. The plugin fails to enforce proper access control checks on requests that return protected content. Default permissions allow anonymous callers to reach data intended for authenticated administrators or specific roles.
Attack Vector
The attack vector is network-based. An attacker sends crafted HTTP requests to the WordPress site hosting the vulnerable plugin. No authentication, no privileges, and no user interaction are required. The attacker recovers sensitive plugin-managed data directly in the HTTP response. See the Patchstack Vulnerability Advisory for technical specifics on the affected request paths.
Detection Methods for CVE-2024-22301
Indicators of Compromise
- Unauthenticated HTTP GET requests targeting wp-content/plugins/albo-pretorio-on-line/ paths from unfamiliar IP addresses.
- Bursts of sequential requests enumerating document identifiers or attachment URLs returned by the plugin.
- Outbound web access logs showing scraping patterns or non-browser user agents pulling notice board content.
Detection Strategies
- Audit WordPress installations and inventory plugin versions, flagging any albo-pretorio-on-line instance at or below 4.6.6.
- Review web server access logs for anomalous request volume against plugin endpoints from a single source IP.
- Correlate file access patterns with WordPress role data to identify unauthenticated reads of protected resources.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized SIEM or data lake for sustained analysis.
- Configure web application firewall rules to alert on requests to plugin endpoints lacking valid session cookies.
- Track integrity of installed WordPress plugins and trigger alerts on version drift or unauthorized changes.
How to Mitigate CVE-2024-22301
Immediate Actions Required
- Update the Albo Pretorio On line WordPress plugin to a version released after 4.6.6 that addresses the issue.
- If no patched version is available, disable or uninstall the plugin until a fix is published by Eduva.
- Restrict access to WordPress sites running the vulnerable plugin using IP allowlists or authentication proxies.
Patch Information
Refer to the Patchstack Vulnerability Advisory for current vendor remediation status. Administrators should monitor the plugin's WordPress.org listing for an official update beyond version 4.6.6. Apply the patch across all WordPress installations as soon as it is released.
Workarounds
- Place the WordPress site behind a web application firewall with rules blocking unauthenticated access to plugin endpoints.
- Use .htaccess or web server access controls to restrict direct requests to wp-content/plugins/albo-pretorio-on-line/ resources.
- Remove or relocate sensitive documents managed by the plugin until a fixed version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
