2 lines
2.7 KiB
JSON
2 lines
2.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WPZOOM Addons for Elementor – Starter Templates & Widgets","vendor":"wpzoom","versions":[{"lessThanOrEqual":"1.3.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users."},{"lang":"es","value":"El plugin WPZOOM Addons para Elementor – Starter Templates & Widgets para WordPress es vulnerable a acceso no autorizado a datos debido a una comprobación de capacidad faltante en la función 'ajax_post_grid_load_more' en todas las versiones hasta la 1.3.2, ambas inclusive. Esto hace posible que atacantes no autenticados recuperen títulos y extractos de publicaciones protegidas (borrador, futuras, pendientes) que no deberían ser accesibles para usuarios no autenticados."}],"id":"CVE-2026-2295","lastModified":"2026-06-17T10:30:44.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-2295","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-02-11T15:20:23.230467Z","version":"2.0.3"}}]},"published":"2026-02-11T10:15:51.357","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.3.1/includes/wpzoom-elementor-ajax-posts-grid.php#L66"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3458416/wpzoom-elementor-addons"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b9961347-7c47-4fa1-af35-609c39a6cd8b?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@wordfence.com","type":"Secondary"}]}
|