Mihdan Public Post Preview Vulnerabilities

The Public Post Preview plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the mppp_toggle function in versions up to, and including, 1.9.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post metadata.

CVSS:

6.5

Affected:

up to 1.9.9

Fixed in:

1.9.10

Disclosed:

Oct 17, 2022