{
 "id": "WPSEC-2026-1237",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1237/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1237/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1237/index.md",
 "title": "Display Post Types <= 3.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Non-Public Post Types",
 "description": "The Display Post Types plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_type' setting of the [dpt] shortcode, block, and widget in all versions up to, and including, 3.4.4. This is because the shared query builder accepts any post type without checking that it is publicly viewable. This makes it possible for authenticated attackers, with Contributor-level access and above, to show and read published entries of non-public, internal post types, such as data stored by other plugins, that are not meant to be visible on the front end.",
 "plugin": {
  "slug": "display-post-types",
  "name": "Display Post Types",
  "full_name": "Display Post Types – Post Grid, post list and post sliders",
  "wordpress_org": "https://wordpress.org/plugins/display-post-types/",
  "advisories_url": "https://wpsec.com/vuln/plugin/display-post-types/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/display-post-types"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.4.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.4.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.4.5",
 "remediation": "Update to 3.4.5 or later.",
 "fix_released": "2026-10-18T02:52:38+00:00",
 "published": "2026-10-19T03:41:25+00:00",
 "updated": "2026-10-18T10:55:43.097622+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1237/",
  "https://plugins.svn.wordpress.org/display-post-types/tags/3.4.5/",
  "https://wordpress.org/plugins/display-post-types/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/display-post-types",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-18"
 }
}