CVE-2022-4239

Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR

Medium · published December 26, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.0th percentile
Published
2022-12-26T12:28Z
EPSS history
Timeline
  • 26 DEC 12:28Z
    Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR
    cvelistv5