WordPress Plugin Vulnerabilities
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
Description
The plugin does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
Proof of Concept
Open the below URL as an unauthenticated user, and this will display the content of the post with ID 1, even if they are draft/private/password protected: https://example.com/wp-admin/admin-ajax.php?action=wpfc_qtip_content&post_id=1
Affects Plugins
Fixed in 1.5 References
CVE
Classification
Type
IDOR
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-01-17 (about 1 years ago)
Added
2023-01-17 (about 1 years ago)
Last Updated
2023-01-23 (about 1 years ago)
WPScan 