CVE-2021-25013CWE-862

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

published January 24, 2022

CVSS
—
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-01-24T08:01Z
EPSS history
Timeline
  • 24 JAN 08:01Z
    Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion
    cvelistv5