Vulnerability CVE-2021-24842
Published: 2021-11-29

Description:
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.

Type:

CWE-862

 (Missing Authorization)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.5/10
4.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Bulk datetime change project -> Bulk datetime change 

 References:
https://wpscan.com/vulnerability/054bd981-dbdd-47dd-bad0-fa327e5860a2
https://plugins.trac.wordpress.org/changeset/2618982
Copyright 2024, cxsecurity.com

 

Back to Top