WP-Recall WordPress Plugin Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the WP-Recall – Registration, Profile, Commerce & More plugin for WordPress, affecting all versions through 16.26.10. The issue arises from insufficient restrictions on which posts can be included via the 'feed' shortcode. This flaw enables unauthenticated attackers to access data from password-protected, private, or draft posts that should otherwise be restricted.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information from protected posts, including password-protected, private, or draft content.

Remediation

Users can update to version 16.26.12 or a newer patched version to address this vulnerability.