# Animated Text Block <= 1.2.6 - Authenticated (Contributor+) Sensitive Information Exposure via 'animated-text' Shortcode

- **ID:** WPSEC-2026-1800
- **Plugin:** Animated Text Block – Add Typing and Looping Text Effects (`animated-text-block`), https://wordpress.org/plugins/animated-text-block/
- **Affected versions:** all versions before 1.2.7
- **Fixed in:** 1.2.7 (Update to 1.2.7 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/animated-text-block
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1800/

## Description

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'animated-text' shortcode in all versions up to, and including, 1.2.6. The shortcode handler renders the content of any post whose ID is passed in the 'id' attribute without checking that the post belongs to the plugin's own post type, and without honouring per-post read restrictions. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed the shortcode in a post and preview it to read published content of other post types that they would otherwise not be able to view, such as posts locked by access-restriction or membership plugins.

## References

- https://wpsec.com/vuln/WPSEC-2026-1800/
- https://plugins.svn.wordpress.org/animated-text-block/tags/1.2.7/
- https://wordpress.org/plugins/animated-text-block/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1800/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.