WordPress Plugin Vulnerabilities

FeedWordPress < 2024.0428 - Unauthenticated Draft Access

Description

The plugin is vulnerable to Insecure Direct Object Reference due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.

Affects Plugins

Plugin icon
feedwordpress
Fixed in 2024.0428

References

CVE
CVE-2024-0839
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1ead46fd-5744-4fbb-9efd-980f9216abbc

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Krzysztof Zając
Verified
No
WPVDB ID
2954ba41-687c-4be8-9f6a-47d9da2ff23e

Timeline

Publicly Published
2024-03-04 (about 2 years ago)
Added
2024-03-04 (about 2 years ago)
Last Updated
2024-05-13 (about 2 years ago)

Other

Published
Title
Published
2026-01-02
Title
Sweet Jane <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-12-27
Title
WooPayments < 6.7.0 - Unauthenticated Order Deletion via IDOR
Published
2024-09-05
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.9 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update
Published
2025-12-05
Title
Fluent Forms < 6.1.8 - Unauthenticated Payment Status Tampering via IDOR
Published
2024-02-05
Title
Minimal Coming Soon – Coming Soon Page < 2.38 - Unauthenticated Maintenance Mode Bypass