CVE-2023-3707: ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure
First published: Mon Oct 16 2023(Updated: )
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
Credit: contact@wpscan.com contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Automattic Activitypub | <1.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-3707?
CVE-2023-3707 is a vulnerability in the ActivityPub WordPress plugin before version 1.0.0.
What is the severity of CVE-2023-3707?
CVE-2023-3707 has a severity rating of 4.3, which is considered medium.
How does CVE-2023-3707 affect the ActivityPub WordPress plugin?
CVE-2023-3707 allows any authenticated user, such as a subscriber, to retrieve the content of arbitrary posts, including drafts and private posts, via an IDOR vector.
How can I fix CVE-2023-3707?
To fix CVE-2023-3707, it is recommended to update the ActivityPub WordPress plugin to version 1.0.0 or above.
Where can I find more information about CVE-2023-3707?
You can find more information about CVE-2023-3707 at the following reference: [LINK]
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/tags
- agent/event
- vendor/automattic
- canonical/automattic activitypub