Vulnerabilities / WebberZone Top 10 / WPSEC-2026-2209
WebberZone Top 10 <= 4.6.0 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode 'post_status' and 'post_type' Attributes
Medium 4.3
CWE-200Fixed in 4.6.1
- ID
- WPSEC-2026-2209
- Plugin
- WebberZone Top 10 — Popular Posts (top-10)
- Affected
- all versions before 4.6.1
- Remediation
- Update to 4.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- WebberZone Top 10 on WPSec AttackSurface
- Fix released
- Published
Description
The WebberZone Top 10 plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_status' and 'post_type' attributes of the [tptn_list] shortcode and block in all versions up to, and including, 4.6.0. This is due to these attributes being passed directly into the posts query without restricting them to public statuses and viewable post types. This makes it possible for authenticated attackers, with contributor-level access and above, to display the titles and links of private, draft and other unpublished posts, as well as content of non-viewable post types.
References
- https://wpsec.com/vuln/WPSEC-2026-2209/
- https://plugins.svn.wordpress.org/top-10/tags/4.6.1/
- https://wordpress.org/plugins/top-10/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS