PT-2021-16188 · WordPress · Find My Blocks

Apple502J · Published 2021-10-18 · Updated 2021-11-04 · CVE-2021-24677

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Find My Blocks WordPress plugin versions prior to 3.4.0

Description The issue concerns a lack of authorization checks in the REST API of the Find My Blocks WordPress plugin. This could allow unauthenticated users to enumerate private posts' titles.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API until the update is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-24677

Affected Products

Find My Blocks

References · 4

• 🔥 https://wpscan.com/vulnerability/40c7e424-9a97-41ab-a312-2a06b607609a · Exploit
• https://osv.dev/vulnerability/CVE-2021-24677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24677 · Security Note
• https://t.me/cibsecurity/30711 · Telegram Post