Lucene search
Apple502jWPEX-ID:45A43927-A427-46BC-9C61-E0B8532C8138HistoryJan 03, 2022 - 12:00 a.m.
Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
2022-01-0300:00:00
apple502j
63
0.001 Low
EPSS
Percentile
25.0%
The plugin contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
As any authenticated user (1764 being the ID of a private/draft post)
https://example.com/wp-admin/admin-ajax.php?action=pdfp_get_doc_meta&id=1764Related
cve
cve
CVE-2021-24868
2022-02-01 13:15:08
cvelist
cvelist
patchstack
patchstack
cnvd
cnvd
WordPress Document Embedder plugin title enumeration vulnerability
2022-02-10 00:00:00
nvd
nvd
CVE-2021-24868
2022-02-01 13:15:08
wpvulndb
wpvulndb
prion
prion
Code injection
2022-02-01 13:15:00