Description
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | My Private Site | < 4.2.3 | 4.2.3 |
References
- https://wpscan.com/vulnerability/54228ea4-eec6-4752-a16e-85209d4445b0/ exploit vdb-entry technical-description