CVE-2023-3707: 
NixOS vulnerability analysis and mitigation

The ActivityPub WordPress plugin before version 1.0.0 contains a security vulnerability identified as CVE-2023-3707. This vulnerability allows any authenticated user, including subscribers, to retrieve the content of arbitrary posts (including drafts and private posts) through an Insecure Direct Object Reference (IDOR) vector. The vulnerability was discovered and publicly disclosed on September 25, 2023. Password-protected posts are not affected by this issue (WPScan Advisory).

The vulnerability stems from the plugin's failure to properly validate that post contents to be displayed are public and belong to the plugin. It has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and falls under the OWASP Top 10 category A5: Broken Access Control (NVD, WPScan Advisory).

The vulnerability allows authenticated users with subscriber-level access to view the content of any post on the system, including private posts and drafts that should not be accessible to them. This represents a significant breach of content confidentiality, potentially exposing sensitive or unpublished information (WPScan Advisory).

The vulnerability can be exploited by sending specific POST requests to the WordPress admin-ajax.php endpoint. An authenticated user can use the developer console to execute commands that retrieve content from arbitrary posts using either the [ap_excerpt] or [ap_content] shortcodes along with a target post ID (WPScan Advisory).

Users are advised to update their ActivityPub WordPress plugin to version 1.0.0 or later, which contains the fix for this vulnerability (WPScan Advisory).