Unauthorized Access to Data in WP Show Posts Plugin Due to Missing Capability Check

CVE-2023-6731

4.3MEDIUM

Key Information

Vendor: Edge22
Status: WP Show Posts
Vendor: CVE Published:; 2 May 2024

Summary

The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.

Affected Version(s)

WP Show Posts <= 1.1.5

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
May 2, 2024
Disclosed
Apr 16, 2024
Vulnerability Reserved.
Dec 12, 2023

Collectors

NVD DatabaseMitre Database

Credit

Lucio Sá