CVE-2020-35934 affects the Advanced Access Manager plugin for WordPress, specifically versions prior to 6.6.2. This vulnerability allows the unfiltered user object, including all metadata, to be displayed upon login via the REST API, potentially exposing sensitive information if other plugins store confidential data in user metadata. Rated as Medium severity (CVSS 4.3), this issue has a low attack complexity and requires low privileges, but it only leads to a low impact on confidentiality (C:L) with no integrity or availability impact. The primary risk is the unauthorized disclosure of user-specific data. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has garnered minimal community discussion and media coverage, suggesting a low level of public awareness or concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.6.2CPE matchmatch criteria | cpe:2.3:a:vasyltech:advanced_access_manager:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.