Threats tagged 'ghsa-fr3x-9wrh-9rp5'

The Animated Text Block plugin for WordPress versions up to and including 1.2.6 contains a vulnerability that allows authenticated users with Contributor-level access or higher to expose sensitive information. This occurs because the plugin's shortcode handler fetches arbitrary posts by attacker-supplied IDs without proper capability checks or validation of post types. As a result, attackers can read the rendered content of any published post, including non-public custom post types that are normally hidden from direct access and the REST API.