CVE-2024-5615: Willnorris Open Graph Information Disclosure

CVE-2024-5615 Overview

The Open Graph plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 1.11.2. The flaw resides in the opengraph_default_description function, which fails to enforce access controls when generating default Open Graph descriptions. Unauthenticated attackers can extract partial content of password-protected blog posts through this weakness. The vulnerability is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The plugin author, willnorris, addressed the issue in a subsequent release tracked in WordPress Change Set 3097574.

Critical Impact
Unauthenticated remote attackers can extract partial content from password-protected WordPress posts, exposing data that site owners intended to restrict.

Affected Products

Willnorris Open Graph plugin for WordPress, all versions through 1.11.2
WordPress sites using the Open Graph plugin without applying the patched release
Multisite WordPress deployments with the Open Graph plugin network-activated

Discovery Timeline

2024-06-06 - CVE-2024-5615 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5615

Vulnerability Analysis

The Open Graph plugin generates metadata used by social platforms when a WordPress URL is shared. The opengraph_default_description function constructs a default description by reading the post excerpt or content. The function does not check whether the underlying post is password-protected before returning content in the Open Graph og:description meta tag.

As a result, when an unauthenticated visitor requests a password-protected post, the rendered page still emits protected content within the Open Graph metadata block. The visible page correctly shows the password prompt, but the HTML <head> section leaks a snippet of the protected text. Attackers can harvest this leaked data without authentication, session establishment, or user interaction.

Root Cause

The root cause is missing access control in the description generation path. The opengraph_default_description function retrieves the post body directly without invoking WordPress helper checks such as post_password_required(). Password protection in WordPress is a presentation-layer restriction, so plugins that read raw post content must explicitly honor that state. The Open Graph plugin omitted that check, exposing an excerpt of the protected content. Details of the affected code path are available in the WordPress plugin code review.

Attack Vector

Exploitation requires only an HTTP GET request to the URL of a password-protected post. The attacker parses the response HTML and extracts the value of the <meta property="og:description"> element. No credentials, tokens, or prior reconnaissance beyond knowing or discovering the post URL are required. Post URLs are frequently indexed by search engines or referenced in navigation, making URL discovery trivial. See the Wordfence vulnerability analysis for further technical context.

No verified proof-of-concept code is published for this issue. The exploitation mechanism is described in prose only.

Detection Methods for CVE-2024-5615

Indicators of Compromise

Unauthenticated HTTP GET requests targeting URLs of known password-protected posts, especially from unfamiliar IP ranges or automated user agents
Web server access logs showing repeated requests to protected post URLs without corresponding password form POST submissions
Unexpected search engine cache entries or social media previews containing snippets of password-protected content

Detection Strategies

Inventory installed WordPress plugins across managed sites and flag any instance of the Open Graph plugin at version 1.11.2 or earlier
Inspect HTML responses from password-protected URLs for a populated og:description meta tag; a populated value on a protected post indicates the vulnerable behavior
Correlate web application firewall (WAF) telemetry with WordPress audit logs to identify scraping patterns against protected content URLs

Monitoring Recommendations

Enable WordPress plugin change tracking and alert on installations of Open Graph plugin versions at or below 1.11.2
Forward web server access logs to a centralized analytics platform and build queries for high-volume requests to ?p= and permalink URLs of protected posts
Monitor outbound crawler activity from search engines to detect indexing of leaked description snippets in cached results

How to Mitigate CVE-2024-5615

Immediate Actions Required

Update the Open Graph plugin to the fixed release published after commit 3097574, which is any version above 1.11.2
Audit password-protected posts for exposure by requesting each URL unauthenticated and inspecting the og:description meta tag
Request removal of cached snippets from major search engines if leaked content is confirmed in public indexes

Patch Information

The plugin author addressed the flaw in the commit tracked at WordPress Change Set 3097574. The fix modifies opengraph_default_description to respect WordPress password protection state before returning post content. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Deactivate the Open Graph plugin until the patched version can be installed on production sites
Remove or disable password protection on posts whose content cannot tolerate any exposure, and use an alternative access control mechanism such as a membership plugin
Deploy a WAF rule that strips or rewrites og:description meta tags in responses for URLs matching password-protected post identifiers

bash

# Update the Open Graph plugin via WP-CLI
wp plugin update opengraph

# Verify the installed version is greater than 1.11.2
wp plugin get opengraph --field=version

# Temporary workaround: deactivate the plugin until patched
wp plugin deactivate opengraph