CVE-2023-1371: W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-04-17 · updated 2026-06-17
Weakness: CWE-862

Description

The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them

Affected products

W4 Post List: before 2.4.6 — fixed in 2.4.6

How to fix

Upgrade to a fixed version: W4 Post List 2.4.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/ad5c167e-77f7-453c-9443-df6e07705d89
https://wpscan.com/vulnerability/ad5c167e-77f7-453c-9443-df6e07705d89

Get alerted when CVE-2023-1371 or the next vulnerability affects your stack