The Loops & Logic WordPress plugin is vulnerable to an unauthenticated information disclosure flaw, potentially exposing sensitive user data and site configuration details to unauthorized actors.

The plugin fails to perform adequate authorization checks on the template-data action, which allows unauthenticated remote attackers to retrieve arbitrary user records and sensitive site settings.

Successful exploitation poses a significant risk to data privacy and site integrity. An attacker can harvest user email addresses and roles, or extract configuration data that may facilitate further attacks, resulting in potential account takeovers or unauthorized system modifications. This vulnerability carries a CVSS score of 7.5, reflecting a high-severity risk due to the ease of exploitation over a network without requiring authentication.

Immediate Action: Update the Loops & Logic WordPress plugin to version 4.3.0 or later immediately to patch the missing authorization check.

Proactive Monitoring: Review web server and application logs for unusual patterns of requests directed at the template-data endpoint, particularly those originating from unauthorized or suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing suspicious parameters associated with the template-data action until the update can be applied.

Public Exploit Available: Unknown.

Given the high impact of this information exposure, administrators must prioritize updating the Loops & Logic plugin to version 4.3.0. Failure to patch allows attackers to gain insight into the site structure and user base, which significantly increases the risk of follow-up attacks. Ensure the update is verified and test the site functionality immediately following the deployment of the patch.