The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles function in all versions up to, and including, 5.0.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the titles of arbitrary posts.
CVSS
No CVSS.
References
Configurations
History
11 Mar 2025, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/browser/bulk-edit-post-titles/trunk/classes/class.bulk.titles.php#L130 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/cad19306-6eef-4f80-9442-e7b314b3a873?source=cve - Third Party Advisory | |
| CPE | cpe:2.3:a:pawaryogesh1989:bulk_edit_post_titles:*:*:*:*:*:wordpress:*:* | |
| First Time |
Pawaryogesh1989
Pawaryogesh1989 bulk Edit Post Titles |
|
| CWE | CWE-862 |
13 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 16:15
Updated : 2025-03-11 16:38
NVD link : CVE-2024-0369
Mitre link : CVE-2024-0369
JSON object : View
Products Affected
pawaryogesh1989
- bulk_edit_post_titles
CWE
CWE-862
Missing Authorization