Description
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the 'get_legacy_cookies' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jottlieb | Last Viewed Posts by WPBeginner | ≤ 1.0.1 | — |