Lucene search

K
wpexploitApple502jWPEX-ID:2AFADC76-93AD-47E1-A224-E442AC41CBCE
HistoryNov 22, 2021 - 12:00 a.m.

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

2021-11-2200:00:00
apple502j
102
logo carousel
shortcode generator
post duplication

EPSS

0.001

Percentile

32.8%

The plugin allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

1) Go to Logo Carousel -> Shortcode Generator.
2) If there is no carousel, create one.
3) Copy URL of the "Duplicate" link under the carousel item.
4) Replace "post" parameter with the post ID of a private post.
5) Visit the link.
6) The private post is duplicated. The post can be viewed at Posts -> All Posts.

e.g: https://example.com/wp-admin/admin.php?action=sp_lc_shortcode_duplicate&post=1764&sp_lc_duplicate_nonce=1c00367003

EPSS

0.001

Percentile

32.8%

Related for WPEX-ID:2AFADC76-93AD-47E1-A224-E442AC41CBCE