Themes Vulnerabilities

Woffice < 4.0.2 - Unauthenticated Disclosure of Notification Titles

Description

The theme lacks authentication checks before returning the titles of notifications between the site's users.

Proof of Concept

Affects Themes

woffice
Fixed in 4.0.2

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
MaxBCM
Submitter
MaxBCM
Submitter website
https://agencemcb.fr
Verified
Yes
WPVDB ID
6b6dae5b-c239-402c-8204-1107d6aae375

Timeline

Publicly Published
2021-08-26 (about 4 years ago)
Added
2021-08-27 (about 4 years ago)
Last Updated
2021-08-27 (about 4 years ago)

Other

Published
Title
Published
2024-11-04
Title
Zotpress < 7.3.13 - Missing Authorization
Published
2021-07-19
Title
RestroPress < 2.8.3.1 - Unauthorised AJAX Calls
Published
2020-11-06
Title
WooCommerce Blocks < 3.7.1 - Guest Account Creation
Published
2022-03-29
Title
Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover
Published
2021-01-13
Title
Elementor Contact Form DB < 1.6 - Unauthenticated & Unauthorised Form Submissions Export