Description
The plugin vulnerable to Broken Access Control in `TenUp\AutoshareForTwitter\Core\Post_Transition\tenup_autoshare_retweet() action.
Authenticated users with any role on the WordPress site could trigger a retweet by manipulating an AJAX request.
It is recommended to update to version 2.3.2 to resolve this issue.
Patches
The issue was fixed in Autopost for X (formerly Autoshare for Twitter) 2.3.2.
References
Thank you @nblirwn for responsibly disclosing this issue.
Reporting security vulnerabilities
Please report security bugs found in the source code of the Autoshare for Twitter plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
nblirwn Reporter
dkotter Remediation developer
peterwilsoncc Remediation reviewer
jeffpaul Coordinator
Description
The plugin vulnerable to Broken Access Control in `TenUp\AutoshareForTwitter\Core\Post_Transition\tenup_autoshare_retweet() action.
Authenticated users with any role on the WordPress site could trigger a retweet by manipulating an AJAX request.
It is recommended to update to version 2.3.2 to resolve this issue.
Patches
The issue was fixed in Autopost for X (formerly Autoshare for Twitter) 2.3.2.
References
Thank you @nblirwn for responsibly disclosing this issue.
Reporting security vulnerabilities
Please report security bugs found in the source code of the Autoshare for Twitter plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.