Hubbub Lite < 1.33.1 – Unauthenticated Password Protected Posts Access | CVE 2024-1526

Description

The plugin does not ensure that user have access to password protected post before displaying its content in a meta tag.

Proof of Concept

When the "Disable Open Graph Meta Tags" settings of the plugin is disabled, view the source of a password protected post and note its content being disclosed in the "og:description" meta property tag.

Affects Plugins

social-pug

Fixed in 1.33.1

References

CVE

CVE-2024-1526

Classification

Type

AUTHBYPASS

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CWE-287

CVSS

5.3 (medium)

Miscellaneous

Original Researcher

Krzysztof Zając (CERT PL)

Submitter

Krzysztof Zając (CERT PL)

Submitter website

https://cert.pl

Submitter twitter

cert_polska_en

Verified

Yes

WPVDB ID

1664697e-0ea3-4d09-b2fd-153a104ec255

Timeline

Publicly Published

2024-03-11 (about 1 year ago)

Added

2024-03-11 (about 1 year ago)

Last Updated

2024-03-11 (about 1 year ago)

Other

Published

Title

Published

2023-06-04

Title

WP User Switch < 1.0.3 - Subscriber+ Authentication Bypass

Published

2014-08-01

Title

WordPress 3.7.1 & 3.8.1 - Potential Authentication Cookie Forgery

Published

2020-11-22

Title

WooCommerce Anti-Fraud < 3.9 - Unauthenticated Order Status Manipulation

Published

2023-11-06

Title

Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post Access

Published

2020-03-26

Title

IMPress for IDX Broker < 2.6.2 - Authenticated Post Creation, Modification, and Deletion