Input validation

2024-03-1316:15:00

PRIOn knowledge base

www.prio-n.com

feedwordpress

insecure direct object reference

unauthenticated access

draft posts

vulnerability

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled ‘guid’ key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.