CVE-2024-6499: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in maxfoundry MaxButtons – Create buttons
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
AI Analysis
Technical Summary
CVE-2024-6499 is an information exposure vulnerability in the MaxButtons – Create buttons WordPress plugin by maxfoundry. It affects all versions up to and including 9.7.8. The flaw allows unauthenticated attackers to retrieve the full path to plugin instances on the server. This information disclosure is categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating network exploitable with low attack complexity and no privileges required, resulting in limited confidentiality impact. No patch or official fix is currently documented.
Potential Impact
An attacker can obtain the full file system path of the MaxButtons plugin installation without authentication. This information disclosure does not directly compromise confidentiality, integrity, or availability but may facilitate further attacks or reconnaissance. There are no known active exploits leveraging this vulnerability at present.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to plugin files or server information that could reveal full paths. Monitor vendor channels for updates and apply patches promptly once released.
CVE-2024-6499: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in maxfoundry MaxButtons – Create buttons
Description
The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-6499 is an information exposure vulnerability in the MaxButtons – Create buttons WordPress plugin by maxfoundry. It affects all versions up to and including 9.7.8. The flaw allows unauthenticated attackers to retrieve the full path to plugin instances on the server. This information disclosure is categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating network exploitable with low attack complexity and no privileges required, resulting in limited confidentiality impact. No patch or official fix is currently documented.
Potential Impact
An attacker can obtain the full file system path of the MaxButtons plugin installation without authentication. This information disclosure does not directly compromise confidentiality, integrity, or availability but may facilitate further attacks or reconnaissance. There are no known active exploits leveraging this vulnerability at present.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to plugin files or server information that could reveal full paths. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-07-03T21:23:16.412Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6c04b7ef31ef0b55f016
Added to database: 2/25/2026, 9:39:16 PM
Last enriched: 4/9/2026, 8:09:33 AM
Last updated: 4/11/2026, 7:06:38 PM
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.