Unauthorized Access Vulnerability in AI Post Generator Plugin for WordPress

CVE-2024-1850

Summary

The AI Post Generator | AutoWriter plugin for WordPress has a vulnerability that allows unauthorized access, modification, or deletion of posts. This flaw arises from a missing capability check on functions associated with AJAX actions across all versions up to and including 3.3. Consequently, authenticated attackers with subscriber access or higher can exploit this vulnerability to view all posts created with the plugin, even those that are unpublished. They can also create new posts, publish unpublished content, and delete existing posts without proper authorization.

References