Unauthenticated Enumeration of Private Post Titles in Find My Blocks WordPress Plugin

CVE-2021-24677 · MEDIUM Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.

Learn more about our Wordpress Pen Testing.