CVE-2023-4036
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The Simple Blog Card WordPress plugin before version 1.32 does not ensure that posts displayed via a shortcode are public, allowing authenticated users, such as subscribers, to access arbitrary post titles and their content, including drafts, private posts, and password-protected ones.
Risk Assessment
The risk is that authenticated users can access sensitive information, potentially leading to the exposure of confidential data within the organization.
Recommendation
It is recommended to update the Simple Blog Card plugin to version 1.32 or later to block access to non-public posts for unauthorized users.
Original NVD description (English source)
The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones