Document Embedder <= 1.7.8 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
2022-01-03 00:00
apple502jStrategic Overview
StatusPatched in 1.7.9
Affected Version
< 1.7.9CVSS4.3Medium
CVE
CVE-2021-24868Vulnerability Overview
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
Technical Analysis
REMEDIATION: Update to version 1.7.9, or a newer patched version --- IDENTIFIER: CWE-285 (Improper Authorization) The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C