CVE-2023-3707

Summary

CVE-2023-3707: The ActivityPub WordPress plugin, prior to version 1.0.0, fails to properly restrict access to post contents, allowing authenticated users, including subscribers, to gain unauthorized access to arbitrary draft or private posts through an Insecure Direct Object Reference (IDOR) vulnerability. This issue does not impact password-protected posts.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.