WordPress Plugin Vulnerabilities
Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR
Description
The plugin, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.
Proof of Concept
Affects Plugins
Fixed in 1.2.4 Affects Themes
Fixed in 1.3.1 References
CVE
URL
Classification
Type
IDOR
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
m0ze
Submitter
m0ze
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-03-31 (about 4 years ago)
Added
2021-04-01 (about 4 years ago)
Last Updated
2021-04-03 (about 4 years ago)
WPScan 