CVE-2019-20209

Description

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.

Weakness classification

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-639: Authorization Bypass Through User-Controlled Key

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory