CVE-2024-10222: Wp Ajax Idor Edit Posts
A WordPress function accesses user input via a superglobal but only checks the generic 'edit_posts' capability. This misses an authorization check at the object level, potentially allowing an attacker to exploit an Insecure Direct Object Reference (IDOR) by passing the ID of a post they do not own. Validate the user's permission to edit the specific post usi
PHPβgreprules fetch cve-2024-10222-wp-ajax-idor-edit-posts --engine opengrepDescription
A WordPress function accesses user input via a superglobal but only checks the generic 'edit_posts' capability. This misses an authorization check at the object level, potentially allowing an attacker to exploit an Insecure Direct Object Reference (IDOR) by passing the ID of a post they do not own. Validate the user's permission to edit the specific post usi
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0