Live › vulnerability › CVE-2026-116613
Go to dashboardVersions up to and including 1.2.6 of the Animated Text Block plugin expose the 'animated-text' shortcode, which renders any published post by ID without checking permissions. An authenticated Contributor can read the content of posts that WordPress normally hides, including private custom post types.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 04:30 UTC. All times on this page are UTC.
Sites running the Animated Text Block plugin at version 1.2.6 or earlier where Contributor-level or higher accounts exist, since those accounts can invoke the shortcode. Sites where untrusted users cannot create content, or that do not use the plugin, can skip it. unknown whether the issue depends on any non-default setting.
No product ranges from the sources yet.
wp plugin get animated-text-block --field=version (slug unverified in sources)1.2.6 (exact fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered block content of any published post, including posts of non-public custom post types (public=false, show_in_rest=false) that WordPress would otherwise hide from direct URLs and the REST API.
This page as .md · .json · in your agent: get_signal("CVE-2026-116613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.