WordPress Plugin Vulnerabilities

EmbedPress < 3.9.13 - Contributor+ PDF Block Embedding

Description

The plugin is vulnerable to unauthorized access of functionality due to insufficient authorization validation on the PDF embed block. This makes it possible for authenticated attackers, with contributor-level access and above, to embed PDF blocks.

Affects Plugins

Plugin icon
embedpress
Fixed in 3.9.13

References

CVE
CVE-2024-1803
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/175e08ce-aec2-427a-90e0-f955711d58b2

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Ngô Thiên An (ancorn_), Dau Hoang Tai
Verified
No
WPVDB ID
ce23ec26-9c61-4546-a179-9fe87019cee4

Timeline

Publicly Published
2024-05-22 (about 2 years ago)
Added
2024-05-23 (about 2 years ago)
Last Updated
2024-05-23 (about 2 years ago)

Other

Published
Title
Published
2022-02-23
Title
WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion
Published
2023-05-12
Title
WPCS – WordPress Currency Switcher Professional < 1.2.0 - Subscriber+ Missing Authorization Checks
Published
2021-11-09
Title
Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
Published
2022-11-14
Title
Transposh WordPress Translation <= 1.0.8 - Settings Update via Authorization Bypass
Published
2024-07-01
Title
LearnPress – WordPress LMS Plugin < 4.2.6.8.2 - Unauthenticated Bypass to User Registration