CVE-2024-56300: WPSpin Information Disclosure Flaw

CVE-2024-56300 Overview

CVE-2024-56300 is a sensitive information disclosure vulnerability in the wpspin Post/Page Copying Tool plugin for WordPress, tracked under the package postpage-import-export-with-custom-fields-taxonomies. The plugin inserts sensitive information into data sent to clients, allowing unauthenticated attackers to retrieve embedded sensitive data over the network. The flaw affects all versions of the plugin from any release through version 2.0.0. The weakness is classified under [CWE-201] (Insertion of Sensitive Information Into Sent Data).

Critical Impact

Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running the affected plugin, with no user interaction required.

Affected Products

• wpspin Post/Page Copying Tool (postpage-import-export-with-custom-fields-taxonomies) plugin for WordPress
• All versions through and including 2.0.0
• WordPress sites with the plugin installed and active

Discovery Timeline

• 2025-01-07 - CVE-2024-56300 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-56300

Vulnerability Analysis

The Post/Page Copying Tool plugin facilitates exporting and importing WordPress posts and pages along with custom fields and taxonomies. The vulnerability stems from the plugin embedding sensitive information into responses sent to clients without adequate access control. Because the issue is reachable over the network without authentication and without user interaction, any remote actor able to query the affected endpoint can extract the disclosed data. The exploitability of this class of weakness is reflected in an EPSS percentile of approximately 72.9, indicating elevated likelihood of attempted exploitation relative to the broader CVE population.

Root Cause

The root cause is improper handling of sensitive information during data export or response generation [CWE-201]. The plugin includes data in transmitted output that should be restricted to privileged users or omitted entirely. No authentication or authorization check gates access to the affected functionality, so the data is returned to any requester.

Attack Vector

An attacker sends a crafted HTTP request to the WordPress endpoint exposed by the plugin. The server responds with output containing embedded sensitive data. The attack requires network access to the WordPress site, no credentials, and no interaction with site users or administrators.

// No verified public exploit code is available for CVE-2024-56300.
// Refer to the Patchstack advisory for technical details:
// https://patchstack.com/database/Wordpress/Plugin/postpage-import-export-with-custom-fields-taxonomies

Detection Methods for CVE-2024-56300

Indicators of Compromise

• Unexpected HTTP requests to plugin endpoints belonging to postpage-import-export-with-custom-fields-taxonomies from external IP addresses.
• Outbound responses from the WordPress site containing post or page export payloads with embedded configuration or metadata fields.
• Repeated unauthenticated requests to /wp-admin/admin-ajax.php or plugin-specific URLs querying export or copy functions.

Detection Strategies

• Inventory all WordPress installations and identify sites running the Post/Page Copying Tool plugin at version 2.0.0 or earlier.
• Review web server access logs for anomalous request patterns targeting plugin export or copy endpoints.
• Inspect HTTP responses from the plugin for sensitive fields that should not be exposed to unauthenticated callers.

Monitoring Recommendations

• Enable verbose access logging on the WordPress front-end and wp-admin paths to capture full request URIs and response sizes.
• Forward web server and WordPress application logs to a centralized analytics platform for anomaly detection.
• Alert on spikes in response size or repeated access to plugin endpoints from a single source.

How to Mitigate CVE-2024-56300

Immediate Actions Required

• Identify all WordPress sites with the Post/Page Copying Tool plugin installed and confirm the installed version.
• Disable or remove the plugin on any site running version 2.0.0 or earlier until a fixed release is verified.
• Restrict network access to administrative and plugin endpoints from untrusted networks where feasible.

Patch Information

At the time of NVD publication, the advisory in the Patchstack WordPress Vulnerability Database lists the issue as affecting versions through 2.0.0. Administrators should consult the Patchstack entry and the plugin's official page on wordpress.org for the latest fixed version and upgrade guidance.

Workarounds

• Deactivate and uninstall the plugin if export and import functionality is not required.
• Use a web application firewall rule to block unauthenticated requests to plugin export endpoints.
• Apply virtual patching at the reverse proxy to filter responses containing sensitive fields until an upstream fix is applied.

# Example: list and deactivate the affected plugin using WP-CLI
wp plugin list --name=postpage-import-export-with-custom-fields-taxonomies --fields=name,status,version
wp plugin deactivate postpage-import-export-with-custom-fields-taxonomies
wp plugin uninstall postpage-import-export-with-custom-fields-taxonomies