CVE-2018-11580 Missing authorization in n/a
Any logged-in user can create unlimited posts due to missing capability checks, enabling denial of service and content spamming.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-11580?
CVE-2018-11580 is a medium-severity missing authorization vulnerability in n/a, published on 31 May 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
Weakness: CWE-79
Which versions are affected by CVE-2018-11580?
It affects 1 product.
Products include Multidots Mass Pages\/Posts Creator.
How do I fix CVE-2018-11580?
No fix has been published for CVE-2018-11580 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-11580 being exploited?
There is no known exploitation of CVE-2018-11580 in the wild and no public exploit code.
Sources
Also known as GHSA-pg4h-w7vr-xpj3.