CVE-2024-4997 describes a missing authorization vulnerability in the WPUpper Share Buttons plugin for WordPress (versions up to and including 3.43). The issue allows unauthenticated attackers to bypass access controls and retrieve the contents of password-protected posts and pages by exploiting the way sharing links are prepared. This vulnerability is identified as CWE-862 and has a CVSS 3.1 score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker without authentication can access the contents of password-protected posts and pages on WordPress sites using the vulnerable WPUpper Share Buttons plugin. This leads to unauthorized disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability, only confidentiality. There are no known exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the WPUpper Share Buttons plugin or restricting access to it. Monitor vendor communications for updates on patches or official mitigations.