Description
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Gutentor | < 4.0.6 | 4.0.6 |
References
- https://wpscan.com/vulnerability/30862f10-a2e6-4536-9a96-bbd8789b954f/ exploit vdb-entry technical-description