CVE-2021-24997 WP Guppy < 1.3 - Sensitive Information Disclosure
Unauthenticated attackers can access sensitive user data and send messages as arbitrary users via unprotected REST API endpoints in the WP Guppy plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24997?
CVE-2021-24997 is a medium-severity missing authorization vulnerability in Unknown WP Guppy, published on 27 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user
Weakness: CWE-862
Which versions are affected by CVE-2021-24997?
It affects 1 product.
Products include Wp-Guppy Wp Guppy.
How do I fix CVE-2021-24997?
No fix has been published for CVE-2021-24997 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24997 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24997 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-f373-v3ww-mcwj.