{
 "id": "WPSEC-2026-1634",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1634/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1634/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1634/index.md",
 "title": "Pz-LinkCard <= 2.6.3 - Authenticated (Contributor+) Sensitive Information Exposure via blogcard Shortcode",
 "description": "The Pz-LinkCard plugin for WordPress is vulnerable to Sensitive Information Exposure via the link card shortcode ('blogcard' by default) and the visual editor card preview AJAX action (pz_lkc_mce_render_card) in all versions up to, and including, 2.6.3, due to link cards for internal URLs being built directly from the target post without checking whether that post is publicly viewable or whether the current user may read it. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the title, content excerpt and thumbnail of private, draft or password-protected posts they should not have access to. Cards placed in published posts can also expose this content to site visitors.",
 "plugin": {
  "slug": "pz-linkcard",
  "name": "Pz-LinkCard",
  "full_name": "Pz-LinkCard",
  "wordpress_org": "https://wordpress.org/plugins/pz-linkcard/",
  "advisories_url": "https://wpsec.com/vuln/plugin/pz-linkcard/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/pz-linkcard"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.6.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.6.4",
 "remediation": "Update to 2.6.4 or later.",
 "fix_released": "2026-10-24T06:32:14+00:00",
 "published": "2026-10-25T06:40:42+00:00",
 "updated": "2026-10-24T10:52:58.544530+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1634/",
  "https://plugins.svn.wordpress.org/pz-linkcard/tags/2.6.4/",
  "https://wordpress.org/plugins/pz-linkcard/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/pz-linkcard",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-25"
 }
}