CVE-2024-1324CWE-862

QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval

Medium · published June 1, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_auto_saved_results() function hooked via a norpriv AJAX in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to retrieve the contents of arbitrary posts that may not be public.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-06-01T06:51Z
EPSS history
Timeline
  • 01 JUN 06:51Z
    QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval
    cvelistv5