CVE-2024-11153: WordPress Content Control Information Disclosure

CVE-2024-11153 Overview

CVE-2024-11153 affects the Content Control plugin for WordPress, a content restriction plugin used to gate posts behind role-based access rules. The vulnerability exposes restricted post content through the WordPress core search feature in all versions up to and including 2.5.0. Unauthenticated attackers can retrieve sensitive data from posts intended only for logged-in users or higher-privilege roles by querying the search endpoint. The flaw is categorized as Sensitive Information Exposure [CWE-200] and requires no authentication or user interaction to exploit.

Critical Impact
Unauthenticated remote attackers can extract restricted post content by leveraging the WordPress search feature to bypass Content Control's access restrictions.

Affected Products

Content Control – The Ultimate Content Restriction Plugin (WordPress plugin)
All versions up to and including 2.5.0
WordPress sites relying on Content Control for role-based post restriction

Discovery Timeline

2025-03-05 - CVE-2024-11153 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11153

Vulnerability Analysis

The Content Control plugin enforces access restrictions on individual WordPress posts based on user roles. The plugin filters direct requests to restricted posts but fails to filter results returned by the WordPress core search functionality. When an unauthenticated visitor performs a site search, the search index and result excerpts still include content from posts that should be hidden from anonymous users.

This allows attackers to enumerate restricted content by submitting crafted search queries. The response body returns titles, excerpts, and portions of restricted post content directly to the unauthenticated requester. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Root Cause

The root cause is incomplete enforcement of access control across all content-delivery paths. Content Control applies restriction logic to single-post views but does not hook into the WordPress search query pipeline (WP_Query with is_search()) to exclude restricted posts from result sets. The vendor patch, visible in the WordPress plugin changeset, extends the restriction filters to cover search queries.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker submits an HTTP GET request to the site's search endpoint (for example /?s=<keyword>) using keywords likely to appear in restricted posts. The response contains excerpts or full content from posts that should be limited to authenticated users. No credentials, tokens, or user interaction are required.

See the Wordfence vulnerability advisory for additional exploitation context.

Detection Methods for CVE-2024-11153

Indicators of Compromise

Unauthenticated HTTP requests to /?s= or /search/ endpoints returning content from posts marked as restricted.
High volumes of search queries from a single IP enumerating keywords or terms likely used in gated content.
Access logs showing anonymous user agents retrieving search result pages containing restricted post titles or excerpts.

Detection Strategies

Compare the set of posts flagged as restricted in the Content Control configuration with posts appearing in anonymous search responses.
Review WordPress access logs for repeated search queries from the same source with varied query terms, which suggests content enumeration.
Audit the installed Content Control plugin version and flag any instance at or below 2.5.0.

Monitoring Recommendations

Enable web server access logging with full query string capture and forward logs to a centralized analytics platform.
Monitor for anomalous spikes in search endpoint traffic from unauthenticated sessions.
Alert on user agents or IPs performing rapid, sequential search requests against the WordPress site.

How to Mitigate CVE-2024-11153

Immediate Actions Required

Update the Content Control plugin to the patched version released after 2.5.0 via the WordPress plugin repository.
Audit all posts currently configured with Content Control restrictions to determine whether restricted content may have been exposed.
Rotate any secrets, internal links, or non-public information that was contained in restricted posts.

Patch Information

The vendor addressed the issue in the release following version 2.5.0. The corresponding source change is documented in the WordPress plugin changeset for content-control. Administrators should update through the WordPress admin dashboard or by pulling the latest release from the Content Control plugin page.

Workarounds

Temporarily disable the Content Control plugin and remove restricted posts from the site until the update is applied.
Use a web application firewall rule to block unauthenticated requests to the search endpoint on sites hosting sensitive gated content.
Move highly sensitive content out of WordPress posts and into an authenticated application layer that does not rely on plugin-level filtering.

bash

# Configuration example: WP-CLI update to the patched Content Control release
wp plugin update content-control
wp plugin get content-control --field=version