Mpcx Lightbox
Monthly
Unauthenticated information disclosure in the MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5) lets any remote visitor call an AJAX action that exposes the title, content, or excerpt of posts they should not be able to read, including private, draft, pending, trashed, and password-protected entries. The flaw carries no authentication or privilege requirement and no user interaction is needed, and WPScan has published a proof-of-concept reference, so publicly available exploit code exists; the vendor has rated the issue as low severity (CVSS 3.1 base 3.7, AC:H), while our assessment scores it 3.1 with AC:L because exploiting the exposed action requires only a direct request to the site's admin-ajax.php endpoint, not special timing or conditions. Practical risk is bounded by data value rather than access difficulty: sites without sensitive unpublished content leak little, and impact is limited to reading post data with no write, privilege escalation, or site takeover.
Unauthenticated information disclosure in the MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5) lets any remote visitor call an AJAX action that exposes the title, content, or excerpt of posts they should not be able to read, including private, draft, pending, trashed, and password-protected entries. The flaw carries no authentication or privilege requirement and no user interaction is needed, and WPScan has published a proof-of-concept reference, so publicly available exploit code exists; the vendor has rated the issue as low severity (CVSS 3.1 base 3.7, AC:H), while our assessment scores it 3.1 with AC:L because exploiting the exposed action requires only a direct request to the site's admin-ajax.php endpoint, not special timing or conditions. Practical risk is bounded by data value rather than access difficulty: sites without sensitive unpublished content leak little, and impact is limited to reading post data with no write, privilege escalation, or site takeover.