CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
Explanation of Vulnerability in Simple Terms
If-So Dynamic Content Personalization versions up to 1.9.2.1 contain an authorization flaw that allows authenticated users to access sensitive information they should not be able to view. The vulnerability requires a valid user account but no special privileges. An attacker with low-level access can read data intended for other users or administrators.
What an attacker can do
Read sensitive information or data belonging to other users or higher-privilege accounts.
Potential impact on your site
Authenticated users can access confidential data beyond their intended permissions, risking data leakage.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
