CVE-2024-12294 is an improper access control vulnerability in the Last Viewed Posts by WPBeginner WordPress plugin, affecting all versions up to and including 1.0.1. The vulnerability arises from the 'get_legacy_cookies' function, which improperly exposes sensitive data to unauthenticated users. This exposure includes titles and permalinks of posts that are private, password-protected, pending, or drafts. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix information is currently available, and the plugin is not a cloud service. No known active exploitation has been reported.

An unauthenticated attacker can extract sensitive information about non-public posts, including their titles and permalinks. This could lead to information disclosure that may aid further attacks or violate confidentiality expectations. There is no indication of integrity or availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the plugin if sensitive post information exposure is a concern. Monitor vendor channels for updates or patches addressing this vulnerability.