Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/613db16a-e1d2-4cdd-8c5c-e370634887a8 İstismar kodu ya da analiz

Kayıt geçmişi

1. 28 Eki 2026 21:10CVSS puanı değişti: – → 2.7
2. 28 Eki 2026 09:00Yayımlandı

İlgili açıklar

• 6,8 CVE-2026-110506Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
• 9,4 CVE-2026-63190FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
• 5,7 CVE-2026-105617PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule
• 5,7 CVE-2026-105616PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
• 2,7 CVE-2026-113494GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
• 5,3 CVE-2026-110509Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler