Vulnerabilities / Really Simple Featured Video / WPSEC-2026-2407
Really Simple Featured Video <= 1.1.0 - Authenticated (Contributor+) Sensitive Information Exposure via Featured Video Block Preview REST Endpoint
Medium 4.3
CWE-200Fixed in 1.2.0
- ID
- WPSEC-2026-2407
- Plugin
- Really Simple Featured Video for Posts, Pages & WooCommerce Products (really-simple-featured-video)
- Affected
- from 1.1.0 before 1.2.0
- Remediation
- Update to 1.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Really Simple Featured Video on WPSec AttackSurface
- Fix released
- Published
Description
The Really Simple Featured Video for Posts, Pages & WooCommerce Products plugin for WordPress is vulnerable to Sensitive Information Exposure via the rsfv/v1/block/preview REST endpoint in all versions up to, and including, 1.1.0, due to the endpoint returning the title of any readable post regardless of post type. This makes it possible for authenticated attackers, with contributor-level access and above, to read the titles of non-public post types such as WooCommerce coupons, whose title is the coupon code.
References
- https://wpsec.com/vuln/WPSEC-2026-2407/
- https://plugins.svn.wordpress.org/really-simple-featured-video/tags/1.2.0/
- https://wordpress.org/plugins/really-simple-featured-video/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS