CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Explanation of Vulnerability in Simple Terms
FancyPost through version 6.0.0 fails to properly check user permissions before allowing modifications to post content. A logged-in user with low privileges can alter posts they should not have access to. The vulnerability requires an active WordPress account but no special interaction from the victim.
What an attacker can do
Modify posts and content they do not own or have permission to edit.
Potential impact on your site
Unauthorized users can alter published or draft posts, potentially defacing content or injecting malicious material.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
