CVE-2024-0421 MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure
Unauthenticated attackers can read arbitrary private and draft posts via an IDOR vulnerability in the MapPress Maps plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0421?
CVE-2024-0421 is a medium-severity vulnerability in Unknown MapPress Maps for WordPress, published on 12 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.
Weakness: CWE-639
Which versions are affected by CVE-2024-0421?
It affects 1 product.
Products include Mappresspro Mappress Maps for Wordpress.
How do I fix CVE-2024-0421?
No fix has been published for CVE-2024-0421 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0421 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-0421 exists.
Other vulnerabilities in Unknown MapPress Maps for WordPress
Sources
Also known as GHSA-63m9-q6cc-99p4.