.. / CVE-2019-16332

Exploit for WordPress API Bearer Auth <20190907 - Cross-Site Scripting (CVE-2019-16332)

Description:

WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting vulnerability. The server parameter is not correctly filtered in swagger-config.yaml.php.

Nuclei Template

View the template here CVE-2019-16332.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-16332.yaml
Copy

References:

https://wpvulndb.com/vulnerabilities/9868
https://packetstormsecurity.com/files/154369/WordPress-API-Bearer-Auth-20181229-Cross-Site-Scripting.html
https://plugins.trac.wordpress.org/changeset/2152730
https://nvd.nist.gov/vuln/detail/CVE-2019-16332
https://wordpress.org/plugins/api-bearer-auth/#developers