Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

2024-03-1900:00:00

Krzysztof Zając (CERT PL)

wpscan.com

combo blocks

unauthenticated access

password protection

ajax

vulnerability

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

21.4%

JSON

Description The plugin does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts

PoC

Open one of the below URL as an unauthenticated user and note that password protected posts are disclosed in it (when the blog has such posts) https://example.com/wp-admin/admin-ajax.php?action=post_grid_paginate_ajax_free https://example.com/wp-admin/admin-ajax.php?action=post_grid_ajax_search_free