CVE-2023-1371 W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure
Authenticated users can bypass password protection to read content of protected posts in the W4 Post List WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1371?
CVE-2023-1371 is a medium-severity missing authorization vulnerability in Unknown W4 Post List, published on 17 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them
Weakness: CWE-862
Which versions are affected by CVE-2023-1371?
It affects 1 product.
Products include W4 Post List Project W4 Post List.
How do I fix CVE-2023-1371?
No fix has been published for CVE-2023-1371 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-1371 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1371 exists.
Other vulnerabilities in Unknown W4 Post List
Sources
Also known as GHSA-f99f-842c-6wrr.