{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-26876/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-26876/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-26876/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-26876/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-26876/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-26876"},"sightings":{"href":"/api/v1/sightings/cve-2020-26876"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-26876.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2020-26876\n\ninfo:\n  name: WordPress WP Courses Plugin Information Disclosure\n  author: dwisiswant0\n  severity: high\n  description: WordPress WP Courses Plugin < 2.0.29 contains a critical information disclosure which exposes private course videos and materials.\n  impact: |\n    An attacker can exploit this vulnerability to gain sensitive information about the WordPress WP Courses Plugin.\n  remediation: |\n    Update to the latest version of the WordPress WP Courses Plugin (1.0.9) to fix the information disclosure vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-26876\n    - https://www.exploit-db.com/exploits/48910\n    - https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/\n    - https://plugins.trac.wordpress.org/changeset/2388997\n    - https://plugins.trac.wordpress.org/changeset/2389243\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2020-26876\n    cwe-id: CWE-306\n    epss-score: 0.10551\n    epss-percentile: 0.95571\n    cpe: cpe:2.3:a:wpcoursesplugin:wp-courses:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 1\n    vendor: wpcoursesplugin\n    product: wp-courses\n    framework: wordpress\n  tags: cve,cve2020,wordpress,wp-plugin,exposure,edb,wpcoursesplugin,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-json/wp/v2/lesson/1\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: regex\n        part: body\n        regex:\n          - \"rest_post_invalid_id\"\n          - \"\\\"(guid|title|content|excerpt)\\\":{\\\"rendered\\\":\"\n        condition: or\n\n      - type: status\n        status:\n          - 200\n          - 404\n        condition: or\n# digest: 4a0a0047304502205709b160653f48b03bf16a8972e9b5d35a9a6295a6421a31852c506bf8aa474802210090a712a8fd786ce08cad8c0a41bef17e5c69c7530267503a4e30d023d63ea70b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-26876"}