Vulnerability detected
-
Just received this:
- Vulnerability: WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 – Broken Access Control vulnerability.
- Severity: Medium.
Needs patching ASAP.
Viewing 2 replies - 1 through 2 (of 2 total)
-
Hi all, thanks for flagging this, we’ve just released an update with this fixed.
FYI the issue was considered low impact, but it was necessary to address.
Essentially, using the individual
[custom-template]shortcode, which allows you to choose any post ID to display, a user (with privliges to create posts on your site) could have passed in an ID for a post they were not allowed to see, and then use the “preview” tool to preview the page with that post content in it.That has now been patched in 1.5.0.
Viewing 2 replies - 1 through 2 (of 2 total)
You must be logged in to reply to this topic.
