CVE-2023-3706

ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure

The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector

Affected

ActivityPub

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.57% chance of exploitation in the next 30 days, 46th percentile

Published

2023-10-16

Updated

2025-04-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/daa4d93a-f8b1-4809-a18e-8ab63a05de5a

References

• CVE Record
• NVD entry