CVE-2024-0839
Last modified
CVE-2024-0839 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.. EPSS estimates a 0.62% chance of exploitation in the next 30 days.
Description
The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Feedwordpress Project | Feedwordpress | < 2024.0428 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-0839?
How severe is CVE-2024-0839?
How do I fix CVE-2024-0839?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-0833In Telerik Test Studio versions prior to v2023.3.1330, a p…7.8
- CVE-2024-0834The Elementor Addon Elements plugin for WordPress is vulnera…5.4
- CVE-2024-0835The Royal Elementor Kit theme for WordPress is vulnerable to…4.3
- CVE-2024-0836The WordPress Review & Structure Data Schema Plugin – Review…4.3
- CVE-2024-0837The Element Pack Elementor Addons (Header Footer, Free Templ…5.4
- CVE-2024-0838The Happy Addons for Elementor plugin for WordPress is vulne…5.4
- CVE-2024-0840The Grandstream UCM Series IP PBX before firmware version 1.…8.8
- CVE-2024-0841A null pointer dereference flaw was found in the hugetlbfs_f…7.8
- CVE-2024-0842The Backuply – Backup, Restore, Migrate and Clone plugin for…7.5
- CVE-2024-0844The Popup More Popups, Lightboxes, and more popup modules pl…7.2
- CVE-2024-0845The PDF Viewer for Elementor plugin for WordPress is vulnera…5.4
- CVE-2024-0847The 5280 Bootstrap Modal Contact Form plugin for WordPress i…4.3
Are you affected by CVE-2024-0839?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST