CVE-2024-11292 is a sensitive information exposure vulnerability (CWE-200) in the WP Private Content Plus WordPress plugin up to version 3.6.1. The flaw arises because the plugin does not properly restrict access to content filtered by the WordPress core search feature, enabling unauthenticated users to retrieve data from posts restricted to privileged roles such as administrators. The vulnerability is network exploitable without authentication and requires no user interaction. The impact is limited to confidentiality loss without affecting integrity or availability.

An unauthenticated attacker can extract sensitive content from posts intended only for higher privileged users, potentially leading to information disclosure. There is no indication of impact on data integrity or service availability. The CVSS score of 5.3 reflects a medium severity level due to the confidentiality impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the WP Private Content Plus plugin or restricting access to the WordPress search feature to trusted users only. Monitor vendor channels for updates and apply any official patches promptly once available.