WordPress Plugin Vulnerabilities

Podlove Web Player < 5.7.4 - Missing Authorization to Unauthenticated Information Exposure

Description

The Podlove Web Player plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /shortcode REST API endpoint in all versions up to, and including, 5.7.3. This makes it possible for unauthenticated attackers to view information they should not have access to.

Affects Plugins

Plugin icon
podlove-web-player
Fixed in 5.7.4

References

CVE
CVE-2024-35710
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2cf779-2355-461f-a289-11612e15acc6

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Peng Zhou
Verified
No
WPVDB ID
31d6c8de-8ce1-429a-a598-1a7d9d291513

Timeline

Publicly Published
2024-06-06 (about 1 year ago)
Added
2024-06-13 (about 1 year ago)
Last Updated
2024-06-13 (about 1 year ago)

Other

Published
Title
Published
2025-12-11
Title
Simple Bike Rental < 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure
Published
2024-04-23
Title
Sirv < 7.2.3 - Missing Authorization to Arbitrary Options Update
Published
2026-01-09
Title
Contest Gallery < 28.1.2 - Missing Authorization
Published
2025-07-23
Title
WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable
Published
2024-12-02
Title
FloristPress < 7.4.0 - Missing Authorization to Sensitive Data Exposure