Leyka, CVE-2023-4917

CVE, Research URL: CVE-2023-4917
Home page URL: Security reports for Leyka
Application: Leyka
Published on: Sep 13, 2023
Research Description: The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.
Affected versions: Min -, max 3.30.7.1.
Status: vulnerable