Read the docs
TI-2023-00711 Aliases CVE-2023-0749GHSA-w72q-xj4x-r776

Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure

Priority MEDIUM 62Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Ocean Extra (Unknown): 2.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownOcean Extrabefore 2.1.32.1.3Patch availableCNA
  • Ocean Extra VendorUnknown Affected before 2.1.3 Fixed in 2.1.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:*before 2.1.3Vulnerableoceanwp
  • cpe:2.3:a:oceanwp:ocean_extra:*:*:*:*:*:wordpress:*:* Versions before 2.1.3 Vulnerable ·oceanwp

Remediation

  • Fix · CNA Ocean Extra (Unknown) Fixed in 2.1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0749
  2. 2026-10-03 Alias added: GHSA-w72q-xj4x-r776
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2022-03118 Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection CVSS 3.1HIGH 7.2
  • TI-2025-03051 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1CRITICAL 9.8
  • TI-2023-26823 WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2019-12232 includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows… CVSS 3.1HIGH 7.5
  • TI-2021-07382 Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2024-24993 WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences