A high-severity sensitive data exposure vulnerability in the Ebook Store plugin allows unauthenticated attackers to extract potentially sensitive information from the application.

The plugin suffers from missing authorization (CWE-862), which allows unauthenticated remote attackers to access sensitive data without requiring prior login or valid user privileges.

Successful exploitation allows unauthorized third parties to access sensitive data, which may include customer details, book sales information, or store configuration data. A CVSS score of 7.5 underscores the potential for significant loss of confidentiality, making this a priority for any organization utilizing the Ebook Store plugin.

Immediate Action: Upgrade the WordPress Ebook Store plugin to version 6.20 or later to ensure proper authorization controls are enforced.

Proactive Monitoring: Monitor server logs for high volumes of unauthorized request attempts and check for unusual data access patterns emanating from public IP addresses.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests attempting to bypass authentication or access restricted endpoints within the Ebook Store plugin directory.

Public Exploit Available: No

Given the ease of exploitation, security administrators must treat this as a high-priority remediation task. Updating to the latest version is the only effective way to prevent unauthorized data access and maintain the confidentiality of the Ebook Store environment.