CVE-2024-3679 is a medium severity information exposure (CVSS 5.3) in the Premium SEO Pack WordPress plugin, in all versions up to and including 1.6.002. Unauthenticated visitors can view limited information from password protected posts through the social meta data. The plugin page says it was closed in March 2025, so plan to replace it.
Weakness class: CWE-200.
What's affected
- Product: Premium SEO Pack, also listed as WP SEO Plugin, by Squirrly.
- Affected: all versions up to and including 1.6.002.
- Fixed version: none confirmed. The WordPress.org page lists 1.6.002 as the current version and says the plugin "has been closed as of March 20, 2025 and is not available for download", with the reason given as author request.
- Access needed: none.
- Severity: Medium, CVSS 5.3, per the record. The KEV flag is false.
How to check if you're exposed
- In the WordPress admin, open Plugins and look for Premium SEO Pack.
- With WP-CLI, list the plugin version.
wp plugin list | grep premium-seo-pack
- List your password protected posts from the Posts screen by filtering on the Protected status in the admin.
- View the page source of one protected post while logged out and look at the social meta tags for excerpt text.
What to do now
- Deactivate and remove Premium SEO Pack, since no fixed release is confirmed and the plugin is closed.
- Replace it with a maintained SEO plugin and recheck your meta tag settings.
- Move truly sensitive content out of password protected posts and into a system with real access control.
- Rotate post passwords if the excerpts exposed anything that matters.
- Add an end of life check to your plugin review, so closed plugins are flagged.
Why it matters
The class is CWE-200, exposure of sensitive information to an unauthorised actor. The plugin builds social meta tags such as Open Graph descriptions from post content, and in doing so includes text that WordPress would hide behind a password prompt. The leak is limited, as the record states, but a short excerpt can still reveal what a protected post is about.
The more important lesson is lifecycle. A closed plugin with a known flaw will not get a fix, and WordPress sites tend to keep such plugins active for years. Treat abandonment as a vulnerability in itself.
Password protected posts are a convenience feature, not a security boundary. If the content is sensitive, do not rely on them.
Quick check
Is there a patched version?
None is confirmed. The plugin page says the plugin was closed and is not available for download.
How serious is it?
The record rates it Medium, 5.3, and says the exposure is limited. Removal is still the clean answer.
Sources
Last reviewed: 19 October 2026.
