CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages.
Explanation of Vulnerability in Simple Terms
VK Blocks versions up to 1.94.2.2 contain an access control flaw that allows authenticated users to read sensitive information they should not have access to. The vulnerability requires a valid user account but no special privileges. An attacker with low-level access can view data that should be restricted to higher-privilege users or other accounts.
What an attacker can do
Read sensitive data or information belonging to other users or restricted areas of the site.
Potential impact on your site
Authenticated users can access confidential information beyond their permission level, risking data exposure.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges; no special interaction required.
Key dates
External resources
Related vulnerabilities
