PT-2024-17596 · WordPress · Get Post Content Shortcode

Francesco Carlucci · Published 2024-12-14 · Updated 2024-12-14 · CVE-2024-12447

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Get Post Content Shortcode plugin for WordPress versions up to, and including, 0.4

Description The issue is related to Insecure Direct Object Reference. This is due to missing validation on a user-controlled key in the 'post-content' shortcode. Authenticated attackers with Contributor-level access and above can read the content of password-protected, private, draft, and pending posts.

Recommendations For versions up to, and including, 0.4, consider disabling the 'post-content' shortcode until a patch is available to prevent exploitation. Restrict access to the shortcode to minimize the risk of unauthorized post content access. Avoid using the 'post-content' shortcode with user-controlled input until the issue is resolved.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-12447

Affected Products

Get Post Content Shortcode

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12447 · Security Note
• https://t.me/cvedetector/12918 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1867869504497197238 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c2b92091-e615-484f-b402-2e793eed214d?source=cve · Note
• https://twitter.com/CVEnew/status/1867908475294003663 · Twitter Post
• https://plugins.trac.wordpress.org/browser/get-post-content-shortcode/trunk/get-post-content-shortcode.php#L106 · Note