PT-2024-15858 · WordPress · Feedwordpress

Krzysztof Zając · Published 2024-03-13 · Updated 2025-03-11 · CVE-2024-0839

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FeedWordPress plugin for WordPress versions up to, and including, 2022.0222

Description The issue is related to Insecure Direct Object Reference due to missing validation on the user-controlled guid key. This allows unauthenticated attackers to view draft posts that may contain sensitive information.

Recommendations For versions up to, and including, 2022.0222, update to a version that includes the necessary validation on the guid key to prevent unauthorized access to draft posts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-0839

Affected Products

Feedwordpress

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-0839 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0839 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/1ead46fd-5744-4fbb-9efd-980f9216abbc?source=cve · Note
• https://wordpress.org/plugins/feedwordpress · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078610%40feedwordpress%2Ftrunk&old=3048697%40feedwordpress%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/cvenotify/114201 · Telegram Post
• https://twitter.com/CVEnew/status/1767941867516129662 · Twitter Post