WordPress Plugin Vulnerabilities

Find My Blocks < 3.4.0 - Private Post Titles Disclosure

Description

The plugin does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.

Proof of Concept

Affects Plugins

Plugin icon
find-my-blocks
Fixed in 3.4.0

References

CVE
CVE-2021-24677

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
40c7e424-9a97-41ab-a312-2a06b607609a

Timeline

Publicly Published
2021-09-15 (about 4 years ago)
Added
2021-09-15 (about 4 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion
Published
2021-04-20
Title
Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions
Published
2021-04-22
Title
Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User
Published
2022-06-27
Title
miniOrange's Google Authenticator < 5.5.75 - Reflected Cross-Site Scripting