CVE-2024-2107 is a medium severity flaw in the Blossom Spa theme for WordPress, scored CVSS 5.8. Unauthenticated visitors can see the contents of password protected or scheduled posts through the generated page source. It affects versions up to and including 1.3.3, so update and check the changelog.
What's affected
The record lists the Blossom Spa theme for WordPress in all versions up to and including 1.3.3. The weakness is CWE-862, missing authorization. NVD scores it 5.8 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. It was published on 2024-03-12.
The record says unauthenticated attackers can extract sensitive data, including the contents of password protected or scheduled posts, via generated source. The CVSS scope is changed, and the vector lists no privileges and no user interaction.
If your site uses password protected posts for client material, or scheduled posts for embargoed announcements, this is the kind of content that should not be readable without the password or before its date.
On the fix: The record references a WordPress.org theme changeset for blossom-spa, but does not name the first fixed version, so check the theme changelog. The vendor advisory in the record is a Wordfence entry, which we could not retrieve, so we have not confirmed a fixed version beyond what the record's references show. The WordPress.org plugin or theme changelog is the authoritative source for the first patched release.
How to check if you're exposed
If you manage WordPress sites, the quickest check is the version list. With WP-CLI, run it from the site root:
wp theme list --fields=name,version,update
wp theme get blossom-spa --field=version
Without shell access, open the Plugins or Themes screen in the dashboard and read the version under the Blossom Spa entry. Anything at 1.3.3 or below is in the affected range.
For a fleet of sites, ask your hosting panel or management tool for an inventory by plugin slug. The slug used by WordPress.org for this item is blossom-spa. Do not forget staging copies, old multisite networks and sites that nobody logs into, because those are the ones that stay out of date.
You can also run the free in-browser dependency scan against a project that vendors this code, and use the Gold page for CVE-2024-2107 to follow the record as new information is added.
What to do now
- List every site that has Blossom Spa installed, and note the version on each.
- Update Blossom Spa to the latest release from WordPress.org. The record names 1.3.3 as the last affected version, so anything newer is the target.
- If you cannot update right now, deactivate and remove it if it is not essential, or restrict access to the affected feature at the web server level.
- Review user accounts. Remove stale users, and check that roles match what each person actually needs.
- Turn on automatic updates for plugins and themes that you trust, so the next fix lands without a ticket.
- Re-check the version after updating and confirm that no cached copy of an old release remains.
Why it matters
Missing authorization flaws like this one tend to appear when a feature is written for a trusted audience and then served to a wider one. Here the theme included post data in the page output without applying the access checks that WordPress normally enforces. The class of problem is missing authorization on data that is sent to the browser.
The practical risk depends on the site. Information exposure on a brochure site is a smaller problem than on a site that holds user data. Use the CVSS score as a starting point, then ask what your site stores. CVE-2024-2107 is not on the CISA Known Exploited Vulnerabilities list, and none of the sources we read report exploitation in the wild.
Quick check
Is CVE-2024-2107 fixed?
The record names 1.3.3 as the last affected version. Update to the newest release and confirm the changelog mentions the fix.
Is CVE-2024-2107 exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
Sources
- Gold entry for CVE-2024-2107
- NVD record for CVE-2024-2107 as held in the Safeguard record set. The Wordfence entry and the WordPress.org changeset referenced by the record could not be retrieved.
Last reviewed: 19 October 2026.
