CVE-2024-10527: Clevelandwebdeveloper Spacer

Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motech_spacer_callback() function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view limited setting information.

Affected products

• Clevelandwebdeveloper Spacer: up to and including 3.0.7

Published 2025-01-07. Last modified 2026-06-17.