5.5

CVE-2021-24842

Exploit

Bulk Datetime Change < 1.12 - Missing Authorisation

Bulk Datetime Change <= 1.11 - Missing Authorisation

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
Mögliche Gegenmaßnahme
Bulk Datetime Change: Update to version 1.12, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Bulk Datetime Change Project ≫ Bulk Datetime Change SwPlatformwordpress Version < 1.12
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Bulk Datetime Change
Version [*, 1.12)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.7% 0.482
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://plugins.trac.wordpress.org/changeset/2618982
Third Party Advisory
Release Notes
https://wpscan.com/vulnerability/054bd981-dbdd-47dd-bad0-fa327e5860a2
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/505e9ba4-a19c-4d51-8ba7-4891bbac603e
Third Party Advisory