CVEs-PoC/2021/CVE-2021-24318.md

### [CVE-2021-24318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24318)
![](https://img.shields.io/static/v1?label=Product&message=Listeo&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.6.11%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen)

### Description

The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector.

### POC

#### Reference
- https://m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-639%5D-Listeo-WordPress-Theme-v1.6.10.txt
- https://wpscan.com/vulnerability/9afa7e11-68b3-4196-975e-8b3f8e68ce56

#### Github
- https://github.com/20142995/nuclei-templates