Vulnerabilities

TI-2025-03461 CVE-2025-3915 · GHSA-q5h6-hwf9-q8q9

Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

LOW 20

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' function in all versions up to, and including, 3.2.0.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00327 Published 2025-04-26 No fix listed CWE-862

TI-2025-03460 CVE-2025-3914 · GHSA-xf25-83cp-2q6v

Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 57

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_downloader' function in all versions up to, and including, 3.2.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.17361 Published 2025-04-26 No fix listed CWE-434

Vulnerabilities

Filters

Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload