Quickcreator AI Blog Writer WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Quickcreator – AI Blog Writer plugin for WordPress, affecting versions 0.0.9 prior to 0.1.17. The issue arises from the presence of a plaintext file, dupasrala.txt, within the plugin's directory, which unintentionally reveals the plugin's API key. This exposure allows unauthenticated attackers to access the API key and use it to perform actions on the site, such as creating new posts and injecting cross-site scripting (XSS) payloads.

Impact

Exploitation of this vulnerability allows for unauthorized access to the plugin's API key, which can be used to create new posts on the WordPress site and inject XSS payloads.