{
 "id": "WPSEC-2026-1800",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1800/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1800/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1800/index.md",
 "title": "Animated Text Block <= 1.2.6 - Authenticated (Contributor+) Sensitive Information Exposure via 'animated-text' Shortcode",
 "description": "The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'animated-text' shortcode in all versions up to, and including, 1.2.6. The shortcode handler renders the content of any post whose ID is passed in the 'id' attribute without checking that the post belongs to the plugin's own post type, and without honouring per-post read restrictions. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in a post and preview it to read published content of other post types that they would otherwise not be able to view, such as posts locked by access-restriction or membership plugins.",
 "plugin": {
  "slug": "animated-text-block",
  "name": "Animated Text Block",
  "full_name": "Animated Text Block – Add Typing and Looping Text Effects",
  "wordpress_org": "https://wordpress.org/plugins/animated-text-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/animated-text-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/animated-text-block"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.2.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.2.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.2.7",
 "remediation": "Update to 1.2.7 or later.",
 "fix_released": "2026-10-27T04:42:22+00:00",
 "published": "2026-10-28T04:42:51+00:00",
 "updated": "2026-10-27T13:05:06.026387+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1800/",
  "https://plugins.svn.wordpress.org/animated-text-block/tags/1.2.7/",
  "https://wordpress.org/plugins/animated-text-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/animated-text-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}