CVE-2024-10802 — Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure
The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in al…
Published: 2024-11-13 · CVSS: 5.3 · CVSS 3.1
The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_get_posts_title_by_id() function in all versions up to, and including, 1.4.7. This makes it possible for unauthenticated attackers to retrieve draft post titles that should not be accessible to unauthenticated users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7