CVE-2024-10285: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in ce21com CE21 Suite
The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token.
AI Analysis
Technical Summary
CVE-2024-10285 affects the CE21 Suite plugin for WordPress, where sensitive information disclosure occurs through the plugin-log.txt file. This file is accessible without authentication, allowing attackers to obtain JWT tokens and subsequently log in as the associated user. The vulnerability impacts versions up to and including 2.2.0. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.
Potential Impact
An unauthenticated attacker can access sensitive information stored in plugin-log.txt, including JWT tokens, which can be used to impersonate users and gain unauthorized access. This compromises user accounts and potentially the entire WordPress site, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin-log.txt file by configuring web server permissions or disabling the logging feature if possible. Monitor vendor channels for updates and apply patches promptly once released.
CVE-2024-10285: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in ce21com CE21 Suite
Description
The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-10285 affects the CE21 Suite plugin for WordPress, where sensitive information disclosure occurs through the plugin-log.txt file. This file is accessible without authentication, allowing attackers to obtain JWT tokens and subsequently log in as the associated user. The vulnerability impacts versions up to and including 2.2.0. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability.
Potential Impact
An unauthenticated attacker can access sensitive information stored in plugin-log.txt, including JWT tokens, which can be used to impersonate users and gain unauthorized access. This compromises user accounts and potentially the entire WordPress site, affecting confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin-log.txt file by configuring web server permissions or disabling the logging feature if possible. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-10-23T07:28:24.003Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6df1b7ef31ef0b59119e
Added to database: 2/25/2026, 9:47:29 PM
Last enriched: 4/9/2026, 11:56:10 AM
Last updated: 4/11/2026, 11:38:06 AM
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.