CVEs-PoC/2021/CVE-2021-24783.md

### [CVE-2021-24783](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24783)
![](https://img.shields.io/static/v1?label=Product&message=Post%20Expirator%3A%20Automatically%20Unpublish%20WordPress%20Posts&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.6.0%3C%202.6.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brighgreen)

### Description

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.

### POC

#### Reference
- https://wpscan.com/vulnerability/de51b970-ab13-41a6-a479-a92cd0e70b71

#### Github
No PoCs found on GitHub currently.