# Pz-LinkCard <= 2.6.3 - Authenticated (Contributor+) Sensitive Information Exposure via blogcard Shortcode

- **ID:** WPSEC-2026-1634
- **Plugin:** Pz-LinkCard (`pz-linkcard`), https://wordpress.org/plugins/pz-linkcard/
- **Affected versions:** all versions before 2.6.4
- **Fixed in:** 2.6.4 (Update to 2.6.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/pz-linkcard
- **Fix released:** 2026-10-24
- **Published:** 2026-10-25
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1634/

## Description

The Pz-LinkCard plugin for WordPress is vulnerable to Sensitive Information Exposure via the link card shortcode ('blogcard' by default) and the visual editor card preview AJAX action (pz_lkc_mce_render_card) in all versions up to, and including, 2.6.3, due to link cards for internal URLs being built directly from the target post without checking whether that post is publicly viewable or whether the current user may read it. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract the title, content excerpt and thumbnail of private, draft or password-protected posts they should not have access to. Cards placed in published posts can also expose this content to site visitors.

## References

- https://wpsec.com/vuln/WPSEC-2026-1634/
- https://plugins.svn.wordpress.org/pz-linkcard/tags/2.6.4/
- https://wordpress.org/plugins/pz-linkcard/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1634/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.