CVE-2019-20209 Missing authorization in n/a
Attackers can delete any page, post, or listing in CityBook, TownHub, or EasyBook WordPress themes via insecure direct object reference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-20209?
CVE-2019-20209 is a high-severity missing authorization vulnerability in n/a, published on 13 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
Which versions are affected by CVE-2019-20209?
It affects 3 products.
Products include Cththemes Citybook, Cththemes Easybook, Cththemes Townhub.
How do I fix CVE-2019-20209?
No fix has been published for CVE-2019-20209 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-20209 being exploited?
There is no known exploitation of CVE-2019-20209 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wp3p-4fj8-x356.