WordPress Plugin Vulnerabilities
Spectra Gutenberg Blocks < 2.19.18 - Unauthenticated Information Disclosure in Sensitive Data
Description
The plugin is vulnerable to Information Disclosure due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for unauthenticated attackers to read excerpts of password-protected posts by simply viewing any page that contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block.
Affects Plugins
References
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
johska
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-02-02 (about 4 months ago)
Added
2026-02-02 (about 4 months ago)
Last Updated
2026-02-02 (about 4 months ago)