FeedWordPress <= 2022.0222 is vulnerable to Insecure Direct Object Reference vulnerability

Unauthenticated

Published
2024-03-03

The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.

CVE

https://www.cve.org/CVERecord?id=CVE-2024-0839

CVSS

Score:5.3

Severity:Medium

Version: 2022.0222

There is a patch available in v2024.0428 and we strongly recommend you update to this version as soon as possible.