WordPress Plugin Vulnerabilities

Spectra Gutenberg Blocks < 2.19.18 - Unauthenticated Information Disclosure in Sensitive Data

Description

The plugin is vulnerable to Information Disclosure due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for unauthenticated attackers to read excerpts of password-protected posts by simply viewing any page that contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block.

Affects Plugins

References

Classification

Type
SENSITIVE DATA DISCLOSURE
CWE

Miscellaneous

Original Researcher
johska
Verified
No

Timeline

Publicly Published
2026-02-02 (about 4 months ago)
Added
2026-02-02 (about 4 months ago)
Last Updated
2026-02-02 (about 4 months ago)

Other