CVE-2014-5337 Missing authorization in n/a
Remote attackers can access sensitive information from password-protected posts via an export action in the WordPress Mobile Pack plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-5337?
CVE-2014-5337 is a medium-severity missing authorization vulnerability in n/a, published on 29 Aug 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.
Weakness: CWE-264
Which versions are affected by CVE-2014-5337?
It affects 2 products.
Products include Wordpress Mobile Pack Project Wordpress Mobile Pack, Wpmobilepack Wordpress Mobile Pack.
How do I fix CVE-2014-5337?
No fix has been published for CVE-2014-5337 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2014-5337 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-5337 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-p9g4-cj6g-47x3.