WP Adminify Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing unauthorized access to sensitive information has been identified in the WP Adminify plugin for WordPress, affecting all versions through 4.0.7.7. This vulnerability arises from the '/wp-json/adminify/v1/get-addons-list' REST API endpoint, which is accessible without authentication. The endpoint exposes a complete list of available addons, including their installation status, version numbers, and download URLs.

Impact

Exploitation of this vulnerability allows for unauthorized users to access sensitive information about installed addons, potentially leading to unauthorized modifications or actions related to those addons.

Remediation

Users are advised to update the WP Adminify plugin to version 4.0.7.8 or later.