{
 "id": "WPSEC-2026-2407",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2407/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2407/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2407/index.md",
 "title": "Really Simple Featured Video <= 1.1.0 - Authenticated (Contributor+) Sensitive Information Exposure via Featured Video Block Preview REST Endpoint",
 "description": "The Really Simple Featured Video for Posts, Pages & WooCommerce Products plugin for WordPress is vulnerable to Sensitive Information Exposure via the rsfv/v1/block/preview REST endpoint in all versions up to, and including, 1.1.0, due to the endpoint returning the title of any readable post regardless of post type. This makes it possible for authenticated attackers, with contributor-level access and above, to read the titles of non-public post types such as WooCommerce coupons, whose title is the coupon code.",
 "plugin": {
  "slug": "really-simple-featured-video",
  "name": "Really Simple Featured Video",
  "full_name": "Really Simple Featured Video for Posts, Pages & WooCommerce Products",
  "wordpress_org": "https://wordpress.org/plugins/really-simple-featured-video/",
  "advisories_url": "https://wpsec.com/vuln/plugin/really-simple-featured-video/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/really-simple-featured-video"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.1.0",
    "from_inclusive": true,
    "to": "1.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.1.0 before 1.2.0"
  ]
 },
 "introduced_in": "1.1.0",
 "fixed_in": "1.2.0",
 "remediation": "Update to 1.2.0 or later.",
 "fix_released": "2026-11-02T15:30:51+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:40:24.329041+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2407/",
  "https://plugins.svn.wordpress.org/really-simple-featured-video/tags/1.2.0/",
  "https://wordpress.org/plugins/really-simple-featured-video/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/really-simple-featured-video",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}