PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 – Private Content Disclosure | CVE 2021-24661 | Plugin Vulnerabilities

Description

The plugin, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID.

Proof of Concept

If the post 1234, created by other users, is set as private, save [gutenberg_post_blocks id="1234"] and preview. The private post's contents will be displayed.

Affects Plugins

Fixed in 2.4.10

References

CVE

Classification

Type

SENSITIVE DATA DISCLOSURE

OWASP top 10

A3: Sensitive Data Exposure

CWE

CVSS

Miscellaneous

Original Researcher

apple502j

Submitter

apple502j

Verified

Yes

WPVDB ID

8d966ff1-9c88-43c7-8f4b-93c88e214677

Timeline

Publicly Published

2021-08-26 (about 4 years ago)

Added

2021-08-26 (about 4 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2025-04-16

Title

Essential Addons for Elementor < 6.1.10 - Contributor+ Information Disclosure

Published

2025-05-16

Title

Wise Chat < 3.3.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

Published

2024-04-15

Title

Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress < 2.0.74 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure

Published

2024-08-28

Title

Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure

Published

2023-09-11

Title

WooCommerce < 7.9 - Unauthenticated Sensitive Information Disclosure