CVEvulnerability
CVE-2024-0839
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-03-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-639
Description
The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.
Affected configurations
• feedwordpress project feedwordpress (< 2024.0428)
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078610%40feedwordpress%2Ftrunk&old=3048697%40feedwordpress%2Ftrunk&sfp_email=&sfph_mail= plugins.trac.wordpress.org
- https://wordpress.org/plugins/feedwordpress/ Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead46fd-5744-4fbb-9efd-980f9216abbc?source=cve Third Party Advisory
- https://wordpress.org/plugins/feedwordpress/ Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead46fd-5744-4fbb-9efd-980f9216abbc?source=cve Third Party Advisory