{
 "id": "WPSEC-2026-2209",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2209/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2209/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2209/index.md",
 "title": "WebberZone Top 10 <= 4.6.0 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode 'post_status' and 'post_type' Attributes",
 "description": "The WebberZone Top 10 plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_status' and 'post_type' attributes of the [tptn_list] shortcode and block in all versions up to, and including, 4.6.0. This is due to these attributes being passed directly into the posts query without restricting them to public statuses and viewable post types. This makes it possible for authenticated attackers, with contributor-level access and above, to display the titles and links of private, draft and other unpublished posts, as well as content of non-viewable post types.",
 "plugin": {
  "slug": "top-10",
  "name": "WebberZone Top 10",
  "full_name": "WebberZone Top 10 — Popular Posts",
  "wordpress_org": "https://wordpress.org/plugins/top-10/",
  "advisories_url": "https://wpsec.com/vuln/plugin/top-10/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/top-10"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.6.1",
 "remediation": "Update to 4.6.1 or later.",
 "fix_released": "2026-11-01T05:29:41+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:57.154351+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2209/",
  "https://plugins.svn.wordpress.org/top-10/tags/4.6.1/",
  "https://wordpress.org/plugins/top-10/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/top-10",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}