Threats tagged 'ghsa-2m52-8826-2mqp'

The Page Builder by SiteOrigin WordPress plugin versions before 2.38.0 have a vulnerability in the Post Loop widget that allows users with contributor role or higher to access draft, pending, scheduled, and private posts and pages of other users. This occurs because the plugin does not restrict query arguments or limit the loop to posts the user is authorized to read.