CVE-2023-1426
WP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure
- State
- Published
- Severity
- 6.5 Medium
- Published
- Apr 10, 2023
- Updated
- Feb 11, 2025
- Reserved
- Mar 16, 2023
Description
The WP Tiles WordPress plugin through 1.1.2 does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
WP TilesUnknown |
|
References
- https://wpscan.com/vulnerability/fdd79bb4-d434-4635-bb2b-84d079ecc746exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.