HubSpot All-In-One Marketing Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress, affecting all versions through 11.3.32. The issue arises in the leadin/public/admin/class-adminconstants.php file, where authenticated attackers with Contributor-level access or higher can access a list of all installed plugins and their versions. This information could be used for reconnaissance and to facilitate further attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information about installed plugins, potentially allowing for targeted attacks based on the versions and types of plugins identified.

Remediation

Users can update to version 11.3.33 or a newer patched version to address this vulnerability.