Button Block – Get fully customizable & multi-functional buttons, CVE-2024-10671
- CVE, Research URL
- Home page URL
-
Security reports for Button Block – Get fully customizable & multi-functional buttons
- Published on
- Nov 21, 2024
- Research Description
- The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
- Affected versions
-
Min -, max 1.1.5.
- Status
-
vulnerable