CVE-2024-1479: WP Show Posts Information Disclosure Flaw

CVE-2024-1479 Overview

CVE-2024-1479 is a sensitive information exposure vulnerability in the WP Show Posts plugin for WordPress. The flaw affects all versions up to and including 1.1.4 and resides in the wpsp_display function. Authenticated attackers with contributor-level access or higher can view the contents of draft, trash, future, private, and pending posts and pages. The issue stems from an authorization failure [CWE-863] in how the plugin retrieves and displays post content without verifying whether the requesting user should have access to non-public statuses.

Critical Impact
Contributor-level accounts can read unpublished, private, and scheduled content across the entire WordPress site, exposing sensitive editorial material.

Affected Products

GeneratePress WP Show Posts plugin versions 1.0.0 through 1.1.4
WordPress sites with WP Show Posts installed and active
Multi-author WordPress environments granting contributor or higher roles to untrusted users

Discovery Timeline

2024-03-13 - CVE-2024-1479 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1479

Vulnerability Analysis

The WP Show Posts plugin exposes a display function, wpsp_display, that queries WordPress posts based on caller-supplied parameters. The function accepts post status arguments including draft, future, private, pending, and trash, then returns matching content. The plugin does not validate whether the authenticated user requesting the render has the WordPress capability required to view posts in those statuses. A contributor, who normally can only see their own drafts and published posts, can invoke the display logic to enumerate unpublished content authored by editors, administrators, or other contributors. The plugin references, WP Show Posts source at line 224 and line 591, show where the query is constructed and rendered without a capability check.

Root Cause

The root cause is missing authorization enforcement in the wpsp_display code path. WordPress provides capability checks such as current_user_can('read_private_posts') and current_user_can('edit_others_posts') to gate access to non-public content. The plugin omits these checks before returning post bodies, mapping to [CWE-863: Incorrect Authorization]. The plugin changeset addresses the gap by restricting status filters and enforcing capability validation.

Attack Vector

Exploitation requires an authenticated session with contributor privileges or higher. The attacker triggers a page or shortcode that invokes wpsp_display with status parameters such as draft or private. The plugin returns the matching post content in the rendered response, disclosing unpublished material. No user interaction from a victim is required, and the attack is conducted over the network against the WordPress front end. Refer to the Wordfence advisory for further technical context.

Detection Methods for CVE-2024-1479

Indicators of Compromise

Requests from contributor accounts to pages or shortcodes that invoke WP Show Posts and return content the user does not own
Access log entries containing shortcode parameters referencing post_status=draft, private, future, pending, or trash
Contributor accounts generating higher-than-normal read volume against pages containing [wp_show_posts] shortcodes

Detection Strategies

Inventory WordPress installations and identify sites running WP Show Posts at version 1.1.4 or earlier
Correlate authenticated user roles with rendered post statuses in application logs to flag mismatches
Review WordPress audit logs for contributor accounts accessing pages that expose non-public content through shortcodes

Monitoring Recommendations

Enable a WordPress activity logging plugin to record content views by role and user
Forward web server access logs to a centralized platform and alert on shortcode parameters that reference non-public post statuses
Monitor plugin version drift so unpatched WP Show Posts instances are surfaced during regular scans

How to Mitigate CVE-2024-1479

Immediate Actions Required

Update the WP Show Posts plugin to the version published in changeset 3041416 or later
Audit contributor and author accounts for unexpected activity and rotate credentials where abuse is suspected
Review draft, private, and pending content for exposure and treat any sensitive material as potentially disclosed

Patch Information

The vendor addressed the vulnerability in the WP Show Posts trunk revision recorded in changeset 3041416. The fix constrains the post statuses that wpsp_display will process and adds capability validation so that only users authorized for a given status receive matching content. Site administrators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Deactivate the WP Show Posts plugin until the patched version can be deployed
Restrict contributor role assignments to trusted users and temporarily downgrade untrusted accounts to subscriber
Remove [wp_show_posts] shortcodes from pages that are accessible to authenticated low-privilege users

bash

# Update WP Show Posts using WP-CLI
wp plugin update wp-show-posts

# Verify installed version
wp plugin get wp-show-posts --field=version

# Temporarily deactivate the plugin if a patch cannot be applied
wp plugin deactivate wp-show-posts