Lucene search
WPScanCVELIST:CVE-2022-3891HistoryFeb 13, 2023 - 2:32 p.m.
CVE-2022-3891 WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
2023-02-1314:32:26
WPScan
www.cve.org
1
wp fullcalendar
wordpress plugin
unauthenticated access
arbitrary posts
0.001 Low
EPSS
Percentile
32.0%
The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
CNA Affected
[
{
"vendor": "Unknown",
"product": "WP FullCalendar",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "1.5"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
cve
cve
CVE-2022-3891
2023-02-13 15:15:14
prion
prion
Design/Logic Flaw
2023-02-13 15:15:00
wpvulndb
wpvulndb
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
2023-01-17 00:00:00
wpexploit
wpexploit
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
2023-01-17 00:00:00
nvd
nvd
CVE-2022-3891
2023-02-13 15:15:14