CVE-2025-14608mediumCWE-862

CVE-2025-14608: fallo de gravedad media en infosatech WP Last Modified Info

WP Last Modified Info <= 1.9.5 - Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WP Last Modified Info

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5. This is due to the plugin not validating a user's access to a post before modifying its metadata in the 'bulk_save' AJAX action. This makes it possible for authenticated attackers, with Author-level access and above, to update the last modified metadata and lock the modification date of arbitrary posts, including those created by Administrators via the 'post_ids' parameter.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
infosatech · WP Last Modified Info
CVEs relacionadas — infosatech WP Last Modified Info

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-6864MEDIUMWP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info ShortcodeEPSS 0.3%