Animated Text Block Add Typing And Looping Text Effects
Monthly
Information disclosure in the Animated Text Block WordPress plugin (versions up to and including 1.2.6) allows an authenticated user with Contributor-level access or higher to read the rendered content of any published post on the site. The 'animated-text' shortcode handler accepts an attacker-supplied post ID and, in its 'publish' branch, renders the post without any capability check and without verifying that the post type is the plugin's own custom post type or is otherwise viewable - so posts in non-public custom post types (public=false, show_in_rest=false) that WordPress normally hides from direct URLs and the REST API can be disclosed. Impact is confidentiality-only (no modification or denial of service), the target post must be in 'publish' status, and no public exploit code or PoC reference is present in the available sources; the vuln.today decision label is this_week.
Information disclosure in the Animated Text Block WordPress plugin (versions up to and including 1.2.6) allows an authenticated user with Contributor-level access or higher to read the rendered content of any published post on the site. The 'animated-text' shortcode handler accepts an attacker-supplied post ID and, in its 'publish' branch, renders the post without any capability check and without verifying that the post type is the plugin's own custom post type or is otherwise viewable - so posts in non-public custom post types (public=false, show_in_rest=false) that WordPress normally hides from direct URLs and the REST API can be disclosed. Impact is confidentiality-only (no modification or denial of service), the target post must be in 'publish' status, and no public exploit code or PoC reference is present in the available sources; the vuln.today decision label is this_week.