{"id":"CVE-2023-1911","aliases":["EUVD-2023-24099","GHSA-v7cp-3qx6-ff4r"],"status":"published","title":"Blocksy Companion \u003c 1.8.82 - Subscriber+ Draft Post Access","description":"The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0055,"percentile":0.46332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2023-05-02T07:04:59Z","modified":"2026-06-17T05:29:01Z","products":[{"vendor":"creativethemes","product":"blocksy_companion"},{"vendor":"creativethemeshq","product":"blocksy companion"},{"vendor":"unknown","product":"blocksy companion"}],"references":[{"url":"https://wpscan.com/vulnerability/e7c52af0-b210-4e7d-a5e0-ee0645ddc08c","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1911"},{"url":"https://github.com/advisories/GHSA-v7cp-3qx6-ff4r"}],"sources":{"cve":[{"id":"CVE-2023-1911","title":"Blocksy Companion \u003c 1.8.82 - Subscriber+ Draft Post Access","description":"The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example","status":"published","published":"2023-05-02T07:04:59.433Z","modified":"2025-01-30T14:29:36.68Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-24099","description":"The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example","status":"published","published":"2023-05-02T07:04:59Z","modified":"2025-01-30T14:29:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:09.506854Z"}],"ghsa":[{"id":"GHSA-v7cp-3qx6-ff4r","title":"The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed...","description":"The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example","status":"published","published":"2023-05-02T09:30:17Z","modified":"2024-04-04T03:46:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:56:18.00765Z"}],"nvd":[{"id":"CVE-2023-1911","description":"The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example","status":"published","published":"2023-05-02T08:15:10.57Z","modified":"2026-06-17T05:29:01.157Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:59.151142Z"}]}}