WordPress Plugin Vulnerabilities
Find My Blocks < 3.4.0 - Private Post Titles Disclosure
Description
The plugin does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
Proof of Concept
Create a private post with at least one Gutenburg paragraph block and go to https://example.com/wp-json/find-my-blocks/blocks/?name=core/paragraph
Affects Plugins
References
CVE
Classification
Type
ACCESS CONTROLS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-09-15 (about 2 years ago)
Added
2021-09-15 (about 2 years ago)
Last Updated
2022-04-08 (about 2 years ago)