The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user
References
Link | Resource |
---|---|
https://github.com/Keyvanhardani/WP-Guppy-A-live-chat-WP-JSON-API-Sensitive-Information-Disclosure | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 | Exploit Third Party Advisory |
Configurations
History
07 Jan 2022, 17:08
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:* | |
CVSS |
v2 : v3 : |
v2 : 6.4
v3 : 6.5 |
First Time |
Wp-guppy
Wp-guppy wp Guppy |
|
References | (MISC) https://github.com/Keyvanhardani/WP-Guppy-A-live-chat-WP-JSON-API-Sensitive-Information-Disclosure - Exploit, Third Party Advisory | |
References | (MISC) https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900 - Exploit, Third Party Advisory |
27 Dec 2021, 12:45
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-12-27 11:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-24997
Mitre link : CVE-2021-24997
CVE.ORG link : CVE-2021-24997
JSON object : View
Products Affected
wp-guppy
- wp_guppy
CWE
CWE-862
Missing Authorization