WordPress Plugin Vulnerabilities

Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure

Description

The plugin contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.

Proof of Concept

As any authenticated user (1764 being the ID of a private/draft post)

https://example.com/wp-admin/admin-ajax.php?action=pdfp_get_doc_meta&id=1764

Affects Plugins

Plugin icon
document-emberdder
Fixed in 1.7.9

References

CVE
CVE-2021-24868

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
45a43927-a427-46bc-9c61-e0b8532c8138

Timeline

Publicly Published
2022-01-03 (about 2 years ago)
Added
2022-01-03 (about 2 years ago)
Last Updated
2022-04-13 (about 2 years ago)

Other

Published
Title
Published
2024-04-29
Title
Media Cleaner: Clean your WordPress! < 6.7.3 - Unauthenticated Information Exposure
Published
2024-02-14
Title
Community by PeepSo < 6.2.7.1 - Unauthenticated Sensitive Information Disclosure via Log file
Published
2022-01-28
Title
Perfect Brands for WooCommerce < 2.0.5 - Subscriber+ Sensitive Information Disclosure
Published
2023-11-06
Title
Restrict Content < 3.2.8 - Information Exposure via legacy log file
Published
2024-02-27
Title
Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure