Pular para o conteúdo
Ver todas as ameaças

CVE-2019-20043

Alvo: Não informado

Descrição

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

Software
Não informado
Tipo Software
Core
CVE
CVE-2019-20043
Tags
Nâo informado
Data de publicação
27/12/2019
Última atualização
21/01/2023
Pontuação em CVSS 3.0
4.3
Médio
plugins premium WordPress