CVE-2024-35690 Overview
CVE-2024-35690 is an information disclosure vulnerability in the MarketingFire Widget Options plugin for WordPress. The flaw allows authenticated users with low privileges, such as subscribers, to retrieve embedded sensitive user metadata that the plugin inserts into data sent through the application. The issue is tracked under CWE-201: Insertion of Sensitive Information Into Sent Data and affects all versions of Widget Options up to and including 4.0.1.
Critical Impact
Authenticated subscriber-level accounts can read user meta data they should not have access to, exposing private information stored on the WordPress site.
Affected Products
- MarketingFire Widget Options WordPress plugin
- Versions from initial release through 4.0.1
- WordPress sites with low-privilege user registration enabled
Discovery Timeline
- 2026-06-17 - CVE-2024-35690 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-35690
Vulnerability Analysis
The Widget Options plugin extends the WordPress widget system with conditional display, visibility, and customization controls. The vulnerability stems from the plugin embedding user meta data into output that is sent to authenticated users without enforcing a strict capability check on the requester. A subscriber-level account, which is the lowest authenticated role in WordPress, can trigger this behavior and read meta values associated with other users.
The vulnerability requires authentication but no user interaction. The attacker operates over the network against the WordPress admin or AJAX endpoint exposed by the plugin. Exposed user meta can include profile data, internal identifiers, and tokens stored by other plugins that hook into the user_meta table.
Root Cause
The root cause is a missing or insufficient authorization check on a plugin handler that returns user meta data. WordPress capability primitives such as current_user_can( 'list_users' ) or edit_users are not enforced before the plugin reads from get_user_meta() and serializes the result into the response. As a result, the plugin treats any authenticated session as authorized to receive the data.
Attack Vector
An attacker first obtains a subscriber account on the target WordPress site, either through open registration or credential reuse. The attacker then issues an authenticated request to the vulnerable plugin endpoint provided by Widget Options. The server returns embedded user meta in the response body, which the attacker parses for sensitive fields. No elevated role, social engineering, or chained vulnerability is required.
No verified public proof-of-concept code is available. See the Patchstack WordPress Vulnerability Advisory for additional technical detail.
Detection Methods for CVE-2024-35690
Indicators of Compromise
- Unexpected authenticated requests from subscriber accounts to Widget Options plugin endpoints under /wp-admin/admin-ajax.php or plugin-specific REST routes.
- Anomalous response sizes from plugin handlers returning serialized user meta payloads.
- New subscriber registrations followed by repeated calls to plugin endpoints within a short window.
Detection Strategies
- Review WordPress access logs for low-privilege users issuing AJAX or REST calls to Widget Options handlers.
- Inspect plugin response bodies in a staging environment to identify which endpoints embed user_meta content.
- Correlate plugin endpoint calls with user role data to surface privilege mismatches between caller and accessed records.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and the WordPress REST API to capture endpoint, user ID, and response length.
- Alert on subscriber-role accounts generating sustained AJAX traffic against plugin endpoints.
- Track plugin version inventory across WordPress estates to identify hosts still running Widget Options 4.0.1 or earlier.
How to Mitigate CVE-2024-35690
Immediate Actions Required
- Update the MarketingFire Widget Options plugin to a version later than 4.0.1 once the vendor publishes a fixed release.
- Audit existing subscriber and low-privilege accounts and remove inactive or unrecognized users.
- Rotate any secrets, API tokens, or recovery values stored in WordPress user meta that may have been exposed.
Patch Information
Refer to the Patchstack advisory for the current patched version and vendor remediation guidance. Subscribe to plugin update notifications in the WordPress admin to receive the fixed release as soon as it is available.
Workarounds
- Disable the Widget Options plugin until a patched version is installed if subscriber-level registration is open on the site.
- Disable open user registration by unchecking Anyone can register under Settings → General to reduce the pool of accounts able to exploit the flaw.
- Place the WordPress admin and AJAX endpoints behind a web application firewall rule that blocks unauthenticated and subscriber traffic to Widget Options handlers.
# Configuration example: disable the plugin from WP-CLI until a fix is available
wp plugin deactivate widget-options
wp plugin status widget-options
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
