{
 "id": "WPSEC-2026-0984",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0984/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0984/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0984/index.md",
 "title": "Nexter Extension – Site Enhancements Toolkit <= 4.7.6 - Authenticated (Subscriber+) Missing Authorization to Post and Term Enumeration via Builder Condition AJAX Actions",
 "description": "The Nexter Extension plugin for WordPress is vulnerable to unauthorized access of data via the nexter_get_particular_posts_query, nxt_singular_preview_type_ajax, nxt_archive_preview_taxonomy_ajax and nxt_singular_archives_filters_ajax AJAX actions in all versions up to, and including, 4.7.6. This is due to missing capability checks on the handlers behind them. This makes it possible for authenticated attackers, with Subscriber-level access and above, to list published posts of any post type they name, including post types that are not public, such as WooCommerce coupon codes. They can also list taxonomy terms and user display names.",
 "plugin": {
  "slug": "nexter-extension",
  "name": "Nexter Extension – Site Enhancements Toolkit",
  "full_name": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/nexter-extension/",
  "advisories_url": "https://wpsec.com/vuln/plugin/nexter-extension/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/nexter-extension"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.7.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.7.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.7.7",
 "remediation": "Update to 4.7.7 or later.",
 "fix_released": "2026-08-19T09:09:49+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:15:57.467625+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0984/",
  "https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.7/",
  "https://wordpress.org/plugins/nexter-extension/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/nexter-extension",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}