CVE-2024-5880 identifies a sensitive information exposure vulnerability in the Hide My Site WordPress plugin by clevelandwebdeveloper. The issue arises because the plugin fails to restrict access to its REST API endpoints when password protection is enabled, allowing unauthenticated attackers to access information that should be protected. This vulnerability affects all versions up to and including 2.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and no required privileges or user interaction. No patch or vendor advisory is currently available to confirm remediation status.

An attacker can gain unauthorized access to sensitive information from a WordPress site using the vulnerable Hide My Site plugin by exploiting unrestricted REST API access. This exposure could lead to information disclosure that may aid further attacks or privacy violations. The vulnerability does not affect integrity or availability, only confidentiality. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling the Hide My Site plugin or restricting REST API access through alternative means such as custom access controls or security plugins that limit REST API exposure. Monitoring for updates from the plugin vendor is recommended.