{
 "id": "WPSEC-2026-2581",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2581/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2581/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2581/index.md",
 "title": "Giveaways and Contests by RafflePress <= 1.12.27 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Giveaway List",
 "description": "The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Sensitive Information Exposure via the RafflePress block editor giveaway list in all versions up to, and including, 1.12.27, due to the rafflepress_enqueue_block_editor_assets() function selecting every column of every giveaway, including the full giveaway settings, and localizing it into the block editor page. This makes it possible for authenticated attackers, with Contributor-level access and above, to read server-side giveaway settings such as the configured reCAPTCHA secret key.",
 "plugin": {
  "slug": "rafflepress",
  "name": "Giveaways and Contests by RafflePress",
  "full_name": "Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers",
  "wordpress_org": "https://wordpress.org/plugins/rafflepress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/rafflepress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/rafflepress"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.12.28",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.12.28"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.12.28",
 "remediation": "Update to 1.12.28 or later.",
 "fix_released": "2026-11-04T12:15:19+00:00",
 "published": "2026-11-05T12:51:17+00:00",
 "updated": "2026-11-05T09:52:24.552465+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2581/",
  "https://plugins.svn.wordpress.org/rafflepress/tags/1.12.28/",
  "https://wordpress.org/plugins/rafflepress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/rafflepress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-05"
 }
}