CVE-2024-1479 is an authorization vulnerability in the WP Show Posts plugin for WordPress, affecting all versions up to and including 1.1.4. The issue arises in the wpsp_display function, which improperly restricts access, allowing authenticated users with contributor or higher privileges to access content that should be restricted, such as draft, trash, future, private, and pending posts and pages. This leads to sensitive information exposure without impacting integrity or availability. The vulnerability has a CVSS 3.1 score of 5.3, reflecting a medium impact primarily on confidentiality.

Authenticated users with contributor or higher privileges can view sensitive unpublished or private content that they should not normally access. This exposure could lead to unauthorized disclosure of confidential or sensitive information contained in draft, trash, future, private, and pending posts and pages. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the WP Show Posts plugin if sensitive unpublished content is a concern. Monitor vendor communications for updates on patches or official fixes.