# Really Simple Featured Video <= 1.1.0 - Authenticated (Contributor+) Sensitive Information Exposure via Featured Video Block Preview REST Endpoint

- **ID:** WPSEC-2026-2407
- **Plugin:** Really Simple Featured Video for Posts, Pages & WooCommerce Products (`really-simple-featured-video`), https://wordpress.org/plugins/really-simple-featured-video/
- **Affected versions:** from 1.1.0 before 1.2.0
- **Fixed in:** 1.2.0 (Update to 1.2.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/really-simple-featured-video
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2407/

## Description

The Really Simple Featured Video for Posts, Pages & WooCommerce Products plugin for WordPress is vulnerable to Sensitive Information Exposure via the rsfv/v1/block/preview REST endpoint in all versions up to, and including, 1.1.0, due to the endpoint returning the title of any readable post regardless of post type. This makes it possible for authenticated attackers, with contributor-level access and above, to read the titles of non-public post types such as WooCommerce coupons, whose title is the coupon code.

## References

- https://wpsec.com/vuln/WPSEC-2026-2407/
- https://plugins.svn.wordpress.org/really-simple-featured-video/tags/1.2.0/
- https://wordpress.org/plugins/really-simple-featured-video/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2407/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.