Threats tagged 'ghsa-ccc5-rp4c-c9x2'

The aBlocks WordPress plugin versions up to and including 2.18.0 contain a vulnerability that allows authenticated users with contributor-level access or higher to expose the full content of password-protected posts by using a shortcode with the post's ID. Users with author-level access or above can publish posts embedding this shortcode, thereby exposing protected content to unauthenticated visitors.