Medium severity4.3NVD Advisory· Published Aug 9, 2023· Updated Apr 8, 2026

CVE-2023-4242

Description

The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.

Affected products

Full/Full Customer
cpe:2.3:a:full:full_-_customer:*:*:*:*:*:wordpress:*:*
Range: <=2.2.3

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837nvdThird Party Advisory
plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.phpnvdProduct
plugins.trac.wordpress.org/browser/full-customer/tags/2.3/app/api/Controller.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000