Animated Text Block <= 1.2.6 - Authenticated (Contributor+) Sensitive Information Exposure via 'animated-text' Shortcode
- ID
- WPSEC-2026-1800
- Plugin
- Animated Text Block – Add Typing and Looping Text Effects (animated-text-block)
- Affected
- all versions before 1.2.7
- Remediation
- Update to 1.2.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Animated Text Block on WPSec AttackSurface
- Fix released
- Published
Description
The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'animated-text' shortcode in all versions up to, and including, 1.2.6. The shortcode handler renders the content of any post whose ID is passed in the 'id' attribute without checking that the post belongs to the plugin's own post type, and without honouring per-post read restrictions. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in a post and preview it to read published content of other post types that they would otherwise not be able to view, such as posts locked by access-restriction or membership plugins.
References
- https://wpsec.com/vuln/WPSEC-2026-1800/
- https://plugins.svn.wordpress.org/animated-text-block/tags/1.2.7/
- https://wordpress.org/plugins/animated-text-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS