Pz-LinkCard <= 2.6.3 - Authenticated (Contributor+) Sensitive Information Exposure via blogcard Shortcode
- ID
- WPSEC-2026-1634
- Plugin
- Pz-LinkCard (pz-linkcard)
- Affected
- all versions before 2.6.4
- Remediation
- Update to 2.6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Pz-LinkCard on WPSec AttackSurface
- Fix released
- Published
Description
The Pz-LinkCard plugin for WordPress is vulnerable to Sensitive Information Exposure via the link card shortcode ('blogcard' by default) and the visual editor card preview AJAX action (pz_lkc_mce_render_card) in all versions up to, and including, 2.6.3, due to link cards for internal URLs being built directly from the target post without checking whether that post is publicly viewable or whether the current user may read it. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the title, content excerpt and thumbnail of private, draft or password-protected posts they should not have access to. Cards placed in published posts can also expose this content to site visitors.
References
- https://wpsec.com/vuln/WPSEC-2026-1634/
- https://plugins.svn.wordpress.org/pz-linkcard/tags/2.6.4/
- https://wordpress.org/plugins/pz-linkcard/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS