SchedulePress – Best Editorial Calendar, Missed Schedule & Auto Social Share, c97a1836615e03be701b5bacba00fa17f6ec2cf7
- CVE, Research URL
- Home page URL
- Published on
- Nov 28, 2023
- Research Description
- SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher [wp-scheduled-posts] < 5.0.5 SchedulePress <= 5.0.4 - Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications The SchedulePress – Best Editorial Calendar, Missed Schedule & Auto Social Share plugin for WordPress is vulnerable to unauthorized modification of data due to improper capability checks on several REST API endpoints in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with contributor-level access and above, to edit other's posts and delete other's posts.
- Affected versions
-
Min -, max 5.0.5.
- Status
-
vulnerable