Search
Find a vulnerability
Search criteria
2 vulnerabilities found for advanced_post_block by abuhayat
CVE-2024-0908 (GCVE-0-2024-0908)
Vulnerability from nvd – Published: 2024-05-02 16:52 – Updated: 2026-04-08 17:06
VLAI
EPSS
VEX
Title
Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure
Summary
The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-02 18:15 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| bplugins | Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters |
Affected:
0 , ≤ 1.13.4
(semver)
|
|
| abuhayat | advanced_post_block |
Affected:
0 , ≤ 1.13.1
(custom)
cpe:2.3:a:abuhayat:advanced_post_block:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:abuhayat:advanced_post_block:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "advanced_post_block",
"vendor": "abuhayat",
"versions": [
{
"lessThanOrEqual": "1.13.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-02T18:15:37.586443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:58:46.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:18:18.916Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/browser/advanced-post-block/trunk/plugin.php#L173"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Post Block \u2013 Showcase Posts with Grid, List, Card Layouts and Filters",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "1.13.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Advanced Post Block \u2013 Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:06:37.650Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/advanced-post-block/trunk/plugin.php#L173"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3081482/advanced-post-block/trunk/plugin.php?old=3077963\u0026old_path=advanced-post-block%2Ftrunk%2Fplugin.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-04-11T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Advanced Post Block \u2013 Display Posts, Pages, or Custom Posts on Your Page \u003c= 1.13.4 - Missing Authorization to Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-0908",
"datePublished": "2024-05-02T16:52:24.157Z",
"dateReserved": "2024-01-25T20:32:16.272Z",
"dateUpdated": "2026-04-08T17:06:37.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-0908 (GCVE-0-2024-0908)
Vulnerability from cvelistv5 – Published: 2024-05-02 16:52 – Updated: 2026-04-08 17:06
VLAI
EPSS
VEX
Title
Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure
Summary
The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-02 18:15 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| bplugins | Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters |
Affected:
0 , ≤ 1.13.4
(semver)
|
|
| abuhayat | advanced_post_block |
Affected:
0 , ≤ 1.13.1
(custom)
cpe:2.3:a:abuhayat:advanced_post_block:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:abuhayat:advanced_post_block:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "advanced_post_block",
"vendor": "abuhayat",
"versions": [
{
"lessThanOrEqual": "1.13.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-02T18:15:37.586443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:58:46.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:18:18.916Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/browser/advanced-post-block/trunk/plugin.php#L173"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Post Block \u2013 Showcase Posts with Grid, List, Card Layouts and Filters",
"vendor": "bplugins",
"versions": [
{
"lessThanOrEqual": "1.13.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Advanced Post Block \u2013 Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:06:37.650Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/advanced-post-block/trunk/plugin.php#L173"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3081482/advanced-post-block/trunk/plugin.php?old=3077963\u0026old_path=advanced-post-block%2Ftrunk%2Fplugin.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-04-11T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Advanced Post Block \u2013 Display Posts, Pages, or Custom Posts on Your Page \u003c= 1.13.4 - Missing Authorization to Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-0908",
"datePublished": "2024-05-02T16:52:24.157Z",
"dateReserved": "2024-01-25T20:32:16.272Z",
"dateUpdated": "2026-04-08T17:06:37.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}