CVE-2024-11181: Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via the 'wpreusablerender' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11181?
CVE-2024-11181 is classified as a medium severity vulnerability due to potential information exposure.
How do I fix CVE-2024-11181?
To fix CVE-2024-11181, update the Greenshift animation and page builder blocks plugin to version 9.9.9.4 or later.
What versions of Greenshift are affected by CVE-2024-11181?
All versions of the Greenshift animation and page builder blocks plugin up to and including 9.9.9.3 are affected by CVE-2024-11181.
What type of vulnerability is CVE-2024-11181?
CVE-2024-11181 is an Information Exposure vulnerability.
What impact does CVE-2024-11181 have on WordPress sites?
CVE-2024-11181 can lead to unauthorized access to sensitive information through the 'wp_reusable_render' shortcode.