Openstation
Monthly
Authorization bypass in the OpenStation - Desktop Windows, Dock & Virtual Desktops for WP Admin WordPress plugin (slug desktop-mode) through version 1.1.7 lets any authenticated user - even one holding only the default 'read' capability that every Subscriber gets - read the title, status, date, permalink and a 300-character content excerpt of private, draft, pending and future posts, as well as the body and AI-moderation verdicts of unapproved and spam comments. The intended 'custom-level access plus enabled AI feature' prerequisite collapses because any logged-in user can self-enable ai.enabled by posting to /desktop-mode/v1/os-settings from the /openstation/ portal. It is a read-only confidentiality leak with no write or code-execution impact, no public exploit identified at time of analysis, and no CISA KEV or EPSS signal, which is consistent with the genuinely low-priority assessment.
Authorization bypass in the OpenStation - Desktop Windows, Dock & Virtual Desktops for WP Admin WordPress plugin (slug desktop-mode) through version 1.1.7 lets any authenticated user - even one holding only the default 'read' capability that every Subscriber gets - read the title, status, date, permalink and a 300-character content excerpt of private, draft, pending and future posts, as well as the body and AI-moderation verdicts of unapproved and spam comments. The intended 'custom-level access plus enabled AI feature' prerequisite collapses because any logged-in user can self-enable ai.enabled by posting to /desktop-mode/v1/os-settings from the /openstation/ portal. It is a read-only confidentiality leak with no write or code-execution impact, no public exploit identified at time of analysis, and no CISA KEV or EPSS signal, which is consistent with the genuinely low-priority assessment.