Read the docs
TI-2023-01296 Aliases CVE-2023-1371GHSA-f99f-842c-6wrr

W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure

Priority MEDIUM 62CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed W4 Post List (Unknown): 2.4.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownW4 Post Listbefore 2.4.62.4.6Patch availableCNA
  • W4 Post List VendorUnknown Affected before 2.4.6 Fixed in 2.4.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:w4_post_list_project:w4_post_list:*:*:*:*:*:wordpress:*:*before 2.4.6VulnerableW4 Post List Project
  • cpe:2.3:a:w4_post_list_project:w4_post_list:*:*:*:*:*:wordpress:*:* Versions before 2.4.6 Vulnerable ·W4 Post List Project

Remediation

  • Fix · CNA W4 Post List (Unknown) Fixed in 2.4.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    W4 Post List 2.4.6

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2023-01298 W4 Post List < 2.4.6 - Reflected XSSPriority MEDIUM 60
    • TI-2023-00358 W4 Post List < 2.4.6 - Contributor+ Stored XSSPriority MEDIUM 58
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1371
  2. 2026-10-03 Alias added: GHSA-f99f-842c-6wrr
  3. 2026-10-13 EPSS moved to the 50th–90th percentile

References

Exploit 1

  • TI-2023-01298 W4 Post List < 2.4.6 - Reflected XSS CVSS 3.1MEDIUM 6.1
  • TI-2023-00358 W4 Post List < 2.4.6 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2023-12145 WordPress W4 Post List Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences