WordPress Plugin Vulnerabilities

ActivityPub for WordPress < 1.0.6 - Unauthenticated REST API Access

Description

The plugin does not properly authorize access to the REST API, allowing an unauthenticated attacker to access restricted endpoints.

Affects Plugins

Plugin icon
activitypub
Fixed in 1.0.6

References

CVE
CVE-2023-52199
URL
https://patchstack.com/database/vulnerability/activitypub/wordpress-activitypub-plugin-1-0-5-unauthenticated-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
Yes
WPVDB ID
5fb58642-61ba-447c-80ac-68d3777486d7

Timeline

Publicly Published
2024-01-05 (about 2 years ago)
Added
2024-01-12 (about 2 years ago)
Last Updated
2024-01-19 (about 2 years ago)

Other

Published
Title
Published
2025-06-05
Title
Viral Loops WP Integration <= 3.8.1 - Missing Authorization
Published
2025-01-06
Title
WP Wand < 1.2.6 - Missing Authorization
Published
2024-02-07
Title
ImageRecycle pdf & image compression < 3.1.14 - Missing Authorization to Settings Update in disableOptimization
Published
2025-03-27
Title
RomethemeKit For Elementor < 1.5.5 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Published
2023-11-09
Title
Ultimate Addons for Contact Form 7 < 3.2.11 - Missing Authorization