Sensitive Information Exposure in WP Show Posts Plugin by WordPress

CVE-2024-1479

Summary

The WP Show Posts plugin for WordPress contains a vulnerability that allows authenticated users with contributor privileges and higher to access sensitive information. This issue arises from the wpsp_display function which fails to adequately restrict access to draft, trash, future, private, and pending posts and pages. As a result, attackers could potentially exploit this flaw to retrieve confidential content that should not be visible to them.

References