Media Cleaner: Clean your WordPress! Vulnerability – Unauthenticated Information Exposure – CVE-2024-33922 | WordPress Plugin Vulnerability Report

Plugin Name: Media Cleaner: Clean your WordPress!

Key Information:

  • Software Type: Plugin
  • Software Slug: media-cleaner
  • Software Status: Active
  • Software Author: tigroumeow
  • Software Downloads: 2,778,078
  • Active Installs: 70,000
  • Last Updated: May 10, 2024
  • Patched Versions: 6.7.3
  • Affected Versions: <= 6.7.2

Vulnerability Details:

  • Name: Media Cleaner: Clean your WordPress! <= 6.7.2
  • Title: Unauthenticated Information Exposure
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE: CVE-2024-33922
  • CVSS Score: 5.3
  • Publicly Published: April 29, 2024
  • Researcher: Joshua Chan
  • Description: The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.2. This vulnerability occurs through publicly exposed log files, which allows unauthenticated attackers to view potentially sensitive information contained within these files.


The Media Cleaner: Clean your WordPress! plugin for WordPress has a vulnerability in versions up to and including 6.7.2 that exposes sensitive information through publicly accessible log files. This vulnerability has been patched in version 6.7.3.

Detailed Overview:

Discovered by researcher Joshua Chan, the vulnerability in the Media Cleaner plugin presents significant security concerns. It specifically involves the exposure of sensitive log files to unauthenticated users, potentially revealing information that could be exploited to further compromise the website. The issue stems from inadequate protections against unauthorized file access, a common oversight that can lead to information leaks. With the release of version 6.7.3, the developers have implemented enhanced security measures to restrict access to these files, effectively mitigating the risk previously presented by this flaw.

Advice for Users:

  • Immediate Action: Update to version 6.7.3 without delay to close the security loophole.
  • Check for Signs of Vulnerability: Review your site's log files for unusual access patterns or entries that could indicate unauthorized access attempts.
  • Alternate Plugins: While a patch is now available, users might consider evaluating other media management plugins that offer robust security features as a precaution.
  • Stay Updated: Continuously monitor and update your WordPress plugins to their latest versions to safeguard against vulnerabilities.


The rapid response by the developers of Media Cleaner: Clean your WordPress! to address this critical security issue highlights the necessity of timely updates. It is imperative for users to apply these updates as soon as they are available to protect their WordPress installations from potential threats. This incident underscores the broader importance of regular security audits and the maintenance of all software components used on your website.


Detailed Report: 

Why Staying Updated Is Your Best Defense Against Website Vulnerabilities

In the digital world, your website acts as both the face and the backbone of your business, but it can also be a gateway for cyber threats if not properly secured. A striking example of such a risk has recently surfaced with the Media Cleaner: Clean your WordPress! plugin, which has been found to expose sensitive information due to a security flaw in versions up to and including 6.7.2. This vulnerability, identified as CVE-2024-33922, has placed numerous websites at risk by allowing unauthenticated access to potentially sensitive log files.

Plugin Details and Vulnerability Insights:

Media Cleaner: Clean your WordPress! is a popular plugin designed to help manage media files within WordPress sites. Developed by tigroumeow and used actively on 70,000 sites, this tool is vital for keeping site media libraries efficient and clean. Unfortunately, versions up to 6.7.2 were found to have a critical flaw where log files could be accessed without authentication, posing a significant security risk.

Vulnerability Overview:

The flaw, identified by security researcher Joshua Chan, allows unauthenticated users to view log files that may contain sensitive information. This information exposure can give attackers insights into the website's operations, potentially leading to further exploits. The vulnerability, cataloged under CVE-2024-33922 with a CVSS score of 5.3, was publicly disclosed on April 29, 2024.

Risks and Potential Impacts:

The exposure of log files to unauthorized persons can lead to severe consequences, including data breaches, privacy violations, and could potentially serve as a stepping stone for more destructive attacks if additional vulnerabilities are discovered from the information obtained. This type of vulnerability is particularly concerning because it does not require advanced skills to exploit and can affect any site using the compromised versions.

Steps for Remediation:

To address this vulnerability, the plugin developers released version 6.7.3, which patches the security flaw by securing access to log files. Website owners should immediately update to this version to prevent unauthorized information access. Additionally, reviewing log files for any unusual access patterns or entries that could indicate past unauthorized access is recommended.

Importance of Regular Updates:

This incident underscores the necessity of keeping all website components—especially plugins—updated. Regular updates are crucial not only for introducing new features but also for closing security gaps that could be exploited by attackers. For small business owners managing their WordPress sites, setting up automatic updates where possible and subscribing to security advisories from plugin developers can help maintain security without requiring constant attention.


The swift action by the developers of Media Cleaner: Clean your WordPress! to mitigate this vulnerability highlights the ongoing challenge of digital security. Staying proactive by updating to version 6.7.3 or later is crucial for securing your WordPress installation. Regularly updating your site's plugins, themes, and core software remains one of the most reliable defenses against the evolving landscape of cyber threats, ensuring that your business's digital presence is both robust and secure.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Media Cleaner: Clean your WordPress! Vulnerability – Unauthenticated Information Exposure – CVE-2024-33922 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment