CVE-2023-5454 Templately < 2.2.6 - Arbitrary post trashing via Missing Authorization

The Templately WordPress plugin before 2.2.6 does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts...

CVE-2023-5454

The CVE concerns the WordPress plugin Templately (versions prior to 2.2.6). Affected component: the saved-templates/delete REST API endpoint. Root cause: improper authorization allows unauthenticated users to perform delete operations. Impact: potential arbitrary post deletion due to missing acce...

WordPress Plugin Templately Access Control Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An Access Control Error vulnerabili...

PT-2023-32113 · WordPress · Templately

Name of the Vulnerable Software and Affected Versions: Templately WordPress plugin versions prior to 2.2.6 Description: The issue concerns improper authorization of the saved-templates/delete API endpoint, allowing unauthenticated users to delete arbitrary posts. Recommendations: For versions pri...

WordPress Plugin Templately Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-5454: Missing Authorization

The Templately WordPress plugin before 2.2.6 does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts...

WordPress Templately Plugin < 2.2.6 is vulnerable to Broken Access Control

Software Templately Type Plugin Vulnerable versions 2.2.6 Fixed in 2.2.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5454 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d43e1c889b21 Credits Krzysztof Zając CERT PL Require...

Templately < 2.2.6 - Unauthenticated Arbitrary Post Deletion

Description The plugin does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts. PoC Ensure the Elementor plugin is installed so that the Elementor Template functionality is enabled. curl -X POST...

Templately < 2.2.6 - Unauthenticated Arbitrary Post Deletion

Description The plugin does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts. Ensure the Elementor plugin is installed so that the Elementor Template functionality is enabled. curl -X POST...