CVE-2024-0421

MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure

Medium · published February 12, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00606 · 48.3th percentile
Published
2024-02-12T16:05Z
EPSS history
Timeline
  • 12 FEB 16:05Z
    MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure
    cvelistv5