Logo Carousel <= 3.4.1 is vulnerable to Unauthorized Private Post Access vulnerability

Contributor

Published
2021-11-21

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

CVE

https://www.cve.org/CVERecord?id=CVE-2021-24739

CVSS

Score:3.8

Severity:Low

Version: 3.4.1

There is a patch available in v3.4.2 and we strongly recommend you update to this version as soon as possible.