WordPress Plugin Vulnerabilities

WP Show Posts < 1.1.5 - Information Exposure

Description

The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wpsp_display function. This makes it possible for authenticated attackers with contributor access and above to view the contents of draft, trash, future, private and pending posts and pages.

Affects Plugins

Plugin icon
wp-show-posts
Fixed in 1.1.5

References

CVE
CVE-2024-1479
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6788e2ee-ce61-494b-8d7f-6d1144466e58

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Webbernaut
Verified
No
WPVDB ID
8f0e3023-1288-44b1-9b20-3abbe2ff7bae

Timeline

Publicly Published
2024-03-01 (about 2 years ago)
Added
2024-03-01 (about 2 years ago)
Last Updated
2024-03-01 (about 2 years ago)

Other

Published
Title
Published
2021-12-28
Title
Shortcode Addons < 3.2.0 - Authenticated Arbitrary Options Update
Published
2024-05-22
Title
EmbedPress < 3.9.13 - Contributor+ PDF Block Embedding
Published
2025-06-11
Title
WordPress Single Sign-On (SSO) - Incorrect Authorization to Sensitive Information Exposure
Published
2025-09-11
Title
Recipe Card Blocks for Gutenberg & Elementor < 3.4.9 - Incorrect Authorization
Published
2024-05-09
Title
LearnPress – WordPress LMS Plugin < 4.2.6.6 - Unauthenticated Bypass to User Registration