Search

Find a vulnerability

Search criteria

    2 vulnerabilities by kevinb

    CVE-2024-11154 (GCVE-0-2024-11154)

    Vulnerability from nvd – Published: 2024-11-20 13:55 – Updated: 2026-04-08 17:21
    VLAI
    Title
    PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
    Summary
    The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-11-20 14:32 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    publishpress PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Affected: 0 , ≤ 3.5.15 (semver)
    		Create a notification for this product.
    kevinb publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes Affected: 0 , ≤ 3.5.15 (semver)
        cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Dominik Dziura
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes",
            "vendor": "kevinb",
            "versions": [
              {
                "lessThanOrEqual": "3.5.15",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11154",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T14:32:46.225820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T14:36:45.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes",
          "vendor": "publishpress",
          "versions": [
            {
              "lessThanOrEqual": "3.5.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dominik Dziura"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the \u0027actAjaxRevisionDiffs\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:21:26.143Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c785b7a0-5091-4d89-87d3-cd7d9984553e?source=cve"
        },
        {
          "url": "https://github.com/publishpress/PublishPress-Revisions/blob/master/admin/history_rvy.php#L322"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/revisionary/trunk/admin/history_rvy.php#L322"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3192492/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-19T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-11154",
    "datePublished": "2024-11-20T13:55:13.662Z",
    "dateReserved": "2024-11-12T17:40:03.390Z",
    "dateUpdated": "2026-04-08T17:21:26.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-11154 (GCVE-0-2024-11154)

    Vulnerability from cvelistv5 – Published: 2024-11-20 13:55 – Updated: 2026-04-08 17:21
    VLAI
    Title
    PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
    Summary
    The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-11-20 14:32 UTC
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    publishpress PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Affected: 0 , ≤ 3.5.15 (semver)
    		Create a notification for this product.
    kevinb publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes Affected: 0 , ≤ 3.5.15 (semver)
        cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Dominik Dziura
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kevinb:publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "publishpress_revisions_duplicate_posts_submit_approve_and_schedule_content_changes",
            "vendor": "kevinb",
            "versions": [
              {
                "lessThanOrEqual": "3.5.15",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11154",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T14:32:46.225820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T14:36:45.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes",
          "vendor": "publishpress",
          "versions": [
            {
              "lessThanOrEqual": "3.5.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dominik Dziura"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the \u0027actAjaxRevisionDiffs\u0027 function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:21:26.143Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c785b7a0-5091-4d89-87d3-cd7d9984553e?source=cve"
        },
        {
          "url": "https://github.com/publishpress/PublishPress-Revisions/blob/master/admin/history_rvy.php#L322"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/revisionary/trunk/admin/history_rvy.php#L322"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3192492/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-19T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \u003c= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-11154",
    "datePublished": "2024-11-20T13:55:13.662Z",
    "dateReserved": "2024-11-12T17:40:03.390Z",
    "dateUpdated": "2026-04-08T17:21:26.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}