CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.
Explanation of Vulnerability in Simple Terms
WP Show Posts versions 1.1.5 and earlier contain an improper access control vulnerability. An authenticated user with low privileges can read sensitive information they should not have access to. The vulnerability requires network access and valid login credentials but no additional user interaction. Site administrators should update to a version newer than 1.1.5.
What an attacker can do
Read sensitive information restricted to higher-privilege users.
Potential impact on your site
Unauthorized disclosure of private content to low-privilege users; data confidentiality breach.
Conditions required to exploit
Valid WordPress login with low-level user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
