Vulnerability · Published Jan 7, 2025 · Assigned by Wordfence
CVE-2024-10536FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export
Medium 4.3
In plain English
A medium-severity missing authorization in FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor from wpqode. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_block_shortcode_export() function in all versions up to, and including, 6.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export shortcodes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpqode | FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor | 0 – through 6.0.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N