CVE-2021-24840
EUVD-2021-1175208.11.2021, 18:15
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| codesupply | squaretype | 𝑥 < 3.0.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration