CVE-2023-6731CWE-285

WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure

Medium · published May 2, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-05-02T16:52Z
EPSS history
Timeline
  • 02 MAY 16:52Z
    WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure
    cvelistv5