CVE-2024-0839 MEDIUM

CVE-2024-0839: FeedWordPress <= 2022.0222 - Insecure Direct Object Referece

Vendor Radgeek
Product FeedWordPress
Weakness CWE-639 · IDOR
Published March 13, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.

Explanation of Vulnerability in Simple Terms

02Summary

FeedWordPress versions up to 2022.0222 expose sensitive information through improper access controls. An unauthenticated attacker can read data that should be restricted, such as feed content or configuration details. The vulnerability requires no user interaction and can be exploited over the network. Update to a version newer than 2022.0222 to remediate.

What an attacker can do

03Attacker Capabilities

Read sensitive feed data or plugin configuration without authentication.

Potential impact on your site

04Site Impact

Unauthorized users can access private feed content and plugin settings exposed by the plugin.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

March 13, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6802 Easy Upload Files During Checkout <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter CVE-2026-9241 FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter CVE-2026-10780 Static Block <= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute CVE-2026-57341 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-12433 Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter