Vulnerabilities / Display Post Types / WPSEC-2026-1237
Display Post Types <= 3.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Non-Public Post Types
Medium 4.3
CWE-200Fixed in 3.4.5
- ID
- WPSEC-2026-1237
- Plugin
- Display Post Types – Post Grid, post list and post sliders (display-post-types)
- Affected
- all versions before 3.4.5
- Remediation
- Update to 3.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-18
- Attack surface
- Display Post Types on WPSec AttackSurface
- Fix released
- Published
Description
The Display Post Types plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_type' setting of the [dpt] shortcode, block, and widget in all versions up to, and including, 3.4.4. This is because the shared query builder accepts any post type without checking that it is publicly viewable. This makes it possible for authenticated attackers, with Contributor-level access and above, to show and read published entries of non-public, internal post types, such as data stored by other plugins, that are not meant to be visible on the front end.
References
- https://wpsec.com/vuln/WPSEC-2026-1237/
- https://plugins.svn.wordpress.org/display-post-types/tags/3.4.5/
- https://wordpress.org/plugins/display-post-types/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS