WordPress Plugin Vulnerabilities

GenerateBlocks < 1.8.3 - Contributor+ Arbitrary Draft/Private Post Access

Description

The plugin is vulnerable to Sensitive Information Exposure via Query Loop, allowing authenticated attackers, with contributor access and above, to see contents of posts and pages in draft or private status as well as those with scheduled publication dates.

Affects Plugins

Plugin icon
generateblocks
Fixed in 1.8.3

References

CVE
CVE-2024-1452
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/62f19301-2311-4989-a5f2-9f845b72dd54

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Webbernaut
Verified
No
WPVDB ID
80cf3a83-100d-40b2-82dc-7b6b4cc3f7c9

Timeline

Publicly Published
2024-03-01 (about 2 years ago)
Added
2024-03-01 (about 2 years ago)
Last Updated
2024-03-01 (about 2 years ago)

Other

Published
Title
Published
2024-07-16
Title
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin < 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
Published
2021-09-29
Title
Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload
Published
2024-06-05
Title
Bookster < 1.2.0 - Unauthenticated Appointment Status Update
Published
2022-02-23
Title
WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion
Published
2025-05-05
Title
Reales WP STPT <= 2.1.2 - Unauthorized User Registration