CVE-2024-5942CWE-639

Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure

Medium · published June 29, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
22.6
In the wild
Unconfirmed
What it is

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00310 · 22.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-06-29T04:33Z
EPSS history
Timeline
  • 29 JUN 04:33Z
    Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure
    cvelistv5