WordPress CVEs

Description

The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.

Affected WordPress components

• Sight – Professional Image Gallery and Portfolio Plugin · sight
  Possible match Active
  Up to and including 1.1.2; Before 1.1.3
  View on WordPress.org
• sight Theme · sight
  Possible match Homeless
  Up to and including 1.1.2; Before 1.1.3
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• codesupplyco Sight – Professional Image Gallery and Portfolio — Up to and including 1.1.2
• codesupplyco sight_professional_image_gallery_and_portfolio — Up to and including 1.1.2
• codesupply sight — Before 1.1.3

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3156405/sight Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/f889342e-03fb-44eb-b5cb-acf115a526c3?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record