# WebberZone Top 10 <= 4.6.0 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode 'post_status' and 'post_type' Attributes

- **ID:** WPSEC-2026-2209
- **Plugin:** WebberZone Top 10 — Popular Posts (`top-10`), https://wordpress.org/plugins/top-10/
- **Affected versions:** all versions before 4.6.1
- **Fixed in:** 4.6.1 (Update to 4.6.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/top-10
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2209/

## Description

The WebberZone Top 10 plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'post_status' and 'post_type' attributes of the [tptn_list] shortcode and block in all versions up to, and including, 4.6.0. This is due to these attributes being passed directly into the posts query without restricting them to public statuses and viewable post types. This makes it possible for authenticated attackers, with contributor-level access and above, to display the titles and links of private, draft and other unpublished posts, as well as content of non-viewable post types.

## References

- https://wpsec.com/vuln/WPSEC-2026-2209/
- https://plugins.svn.wordpress.org/top-10/tags/4.6.1/
- https://wordpress.org/plugins/top-10/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2209/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.