From 567931394420d3de32bb43291f10dc3b1d20d4be Mon Sep 17 00:00:00 2001 From: Brian Willows Date: Mon, 31 Aug 2026 14:25:59 +0100 Subject: [PATCH] Security: restrict unauthenticated lightbox_get_image_title to published posts The wp_ajax_nopriv_lightbox_get_image_title endpoint returned the title, content or excerpt of any post ID supplied by an anonymous visitor, disclosing private, draft, pending, trashed and password-protected post content (CWE-862 / CWE-200). Only return data for publicly published, non-password-protected posts. --- wordpress/trunk/mpcx-lightbox.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/wordpress/trunk/mpcx-lightbox.php b/wordpress/trunk/mpcx-lightbox.php index c0fc662..a8b26e2 100644 --- a/wordpress/trunk/mpcx-lightbox.php +++ b/wordpress/trunk/mpcx-lightbox.php @@ -271,6 +271,15 @@ function lightbox_get_image_title() { $options = get_option( 'mpcx_lightbox' ); $titleId = intval( $options['title'] ); $post = get_post( intval( $_POST['postId'] ) ); + + // Only expose data for publicly visible posts. Without this check the + // unauthenticated wp_ajax_nopriv endpoint returns the title, content or + // excerpt of ANY post ID - including private, draft, pending, trashed or + // password-protected posts - to anonymous visitors (CWE-862 / CWE-200). + if ( ! $post || 'publish' !== get_post_status( $post ) || ! empty( $post->post_password ) ) { + die( json_encode( '' ) ); + } + switch ( $titleId ) { case 1: $title = $post->post_title;