CVE-2023-1426

🗓️ 10 Apr 2023 13:17:55Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

The WP Tiles WordPress plugin through 1.1.2 allows authenticated users to retrieve titles of draft and private posts

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-1426	10 Apr 202318:32	–	circl
CNNVD	WordPress plugin WP Tile 信息泄露漏洞	10 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-1426 WP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure	10 Apr 202313:17	–	cvelist
EUVD	EUVD-2023-23679	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1426	10 Apr 202314:15	–	nvd
OSV	CVE-2023-1426	10 Apr 202314:15	–	osv
Patchstack	WordPress WP Tiles Plugin <= 1.1.2 is vulnerable to Sensitive Data Exposure	11 Apr 202300:00	–	patchstack
Prion	Type confusion	10 Apr 202314:15	–	prion
Positive Technologies	PT-2023-16974 · WordPress · Wp Tiles	10 Apr 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-1426	23 May 202502:59	–	redhatcve

NVD

Vulners

Node

keetrax wp_tilesRange≤1.1.2wordpress

[
  {
    "vendor": "Unknown",
    "product": "WP Tiles",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "1.1.2"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/fdd79bb4-d434-4635-bb2b-84d079ecc746

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Authenticated users can retrieve draft/private post titles via admin-ajax.php using the parse-media-shortcode shortcode.
shortcode	request body	wp-admin/admin-ajax.php	Authenticated users can retrieve draft/private post titles via admin-ajax.php using the parse-media-shortcode shortcode.

11 Feb 2025 22:15Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.5

EPSS0.00515

SSVC