CVE-2023-1911 Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access

2023-05-0207:04:59

WPScan

www.cve.org

blocksy companion

wordpress

plugin

security

draft posts

access

cve-2023-1911

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.7%

JSON

The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Blocksy Companion",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.8.82"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]