Filtered by vendor Alex Kirk Subscriptions
Filtered by product Friends Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-12028 1 Alex Kirk 1 Friends 2024-12-06 5.3 Medium
The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to send arbitrary friend requests on behalf of another website, accept the friend request for the targeted website, and then communicate with the site as an accepted friend.