Skip to content
OpenAdvisories

Vendor

akirk

3 known vulnerabilities.

Products

Friends 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-12028

    Friends <= 3.2.1 - Missing Authorization

    The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to send arbitrary friend re…

    akirk Friends Web / CMS
  • Medium 5.5
    CVE-2024-1978

    Friends <= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery

    The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_available_feeds function. This makes it possible for authenticated attackers, with administrator-level access and above,…

    akirk Friends Web / CMS