CVE-2020-9514: idxbroker impress for idx broker

csirt@kutim:~/threat-intel/cve/CVE-2020-9514

CVSS 6.5 · Medium EPSS 0,96%

Kerentanan Missing Authorization pada idxbroker impress for idx broker. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages (via create_dynamic_page and delete_dynamic_page).

Rincian

Terbit di NVD: 7 April 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
idxbroker	impress for idx broker	Semua versi sebelum 2.6.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-impress-for-idx-broker/ exploit · advisory pihak ketiga
https://wordpress.org/plugins/idx-broker-platinum/#developers product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.