WordPress Plugin Vulnerabilities

WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access

Description

The plugin does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.

Proof of Concept

Open the below URL as an unauthenticated user, and this will display the content of the post with ID 1, even if they are draft/private/password protected:

https://example.com/wp-admin/admin-ajax.php?action=wpfc_qtip_content&post_id=1

Affects Plugins

Plugin icon
wp-fullcalendar
Fixed in 1.5

References

CVE
CVE-2022-3891

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Lana Codes
Submitter
Lana Codes
Submitter website
https://lana.codes/
Submitter twitter
LanaCodes
Verified
Yes
WPVDB ID
5a69965d-d243-4d51-b7a4-d6f4b199abf1

Timeline

Publicly Published
2023-01-17 (about 10 months ago)
Added
2023-01-17 (about 10 months ago)
Last Updated
2023-01-23 (about 10 months ago)

Other

Published
Title
Published
2022-09-26
Title
wpForo Forum < 2.0.6 - Subscriber+ Forum Post Set as Solved/Unsolved via IDOR
Published
2023-06-29
Title
SP Project & Document Manager < 4.68 - Subscriber+ Insecure Direct Object References
Published
2023-02-27
Title
WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR
Published
2023-09-22
Title
Pre-Publish Checklist < 1.1.2 - Insecure Direct Object Reference to Arbitrary Post '_ppc_meta_key' Update
Published
2022-10-21
Title
Quiz And Survey Master < 7.3.7 - Multiple Author+ IDOR