WP Show Posts Vulnerability – Improper Authorization to Information Exposure – CVE-2023-6731 | WordPress Plugin Vulnerability Report

Plugin Name: WP Show Posts

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-show-posts
  • Software Status: Active
  • Software Author: edge22
  • Software Downloads: 534,403
  • Active Installs: 90,000
  • Last Updated: April 25, 2024
  • Patched Versions: 1.1.6
  • Affected Versions: <= 1.1.5

Vulnerability Details:

  • Name: WP Show Posts <= 1.1.5
  • Title: Improper Authorization to Information Exposure
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • CVE: CVE-2023-6731
  • CVSS Score: 4.3
  • Publicly Published: April 16, 2024
  • Researcher: Lucio Sá
  • Description: The WP Show Posts plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on multiple AJAX functions. This flaw allows authenticated attackers, with subscriber-level access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.


The WP Show Posts plugin for WordPress has a vulnerability in versions up to and including 1.1.5 that allows authenticated users to improperly access sensitive information. This vulnerability has been addressed in version 1.1.6.

Detailed Overview:

Identified by researcher Lucio Sá, this vulnerability arises from insufficient authorization controls within the plugin’s AJAX functionalities. Specifically, the plugin failed to adequately verify user permissions before allowing access to sensitive post metadata and other content data structures. The implications of such exposure include potential privacy breaches and unauthorized data manipulation, albeit without direct implications for data integrity or availability.

Advice for Users:

  • Immediate Action: Users are strongly encouraged to update to version 1.1.6 immediately to mitigate the risks posed by this vulnerability.
  • Check for Signs of Vulnerability: Administrators should audit their site logs for any unusual access patterns or queries that might suggest exploitation of this flaw.
  • Alternate Plugins: While the vulnerability has been patched, users may wish to explore alternative plugins that offer similar functionalities but with a strong emphasis on security, especially if they have heightened security needs.
  • Stay Updated: Consistently keeping plugins updated to the latest versions is crucial for maintaining site security and integrity.


The rapid response of the developers in patching this vulnerability underscores the critical nature of timely software updates in safeguarding WordPress sites against potential threats. The WP Show Posts plugin's vulnerability highlights the ongoing need for vigilance in monitoring and updating site components, especially those that interact with sensitive information. Users are reminded of the importance of applying updates as soon as they become available and maintaining robust security practices to protect their digital assets.


Detailed Report: 

In today’s digital landscape, the security of online platforms hinges not just on the robustness of their architecture but also on the vigilance with which they are updated. A recent vulnerability in the "WP Show Posts" plugin, widely used across 90,000 WordPress sites, has brought this issue into sharp focus. Identified as CVE-2023-6731, this security flaw exposed sites to potential unauthorized data access, underscoring the critical importance of regular updates to safeguard user information and maintain trust.

Risks and Potential Impacts

This vulnerability could allow attackers to gain insights into sensitive information that could be leveraged for further attacks or data breaches. Although the information exposure does not directly affect the integrity or availability of the site, the breach of confidentiality can still undermine user trust and compliance with data protection regulations.

Remediation Steps

  • Immediate Update Required: Users must update to version 1.1.6 immediately, which has patched this security flaw.
  • Review Site Logs: Admins should review their site logs for any unusual access patterns or queries that could suggest exploitation of this flaw.
  • Consider Alternate Plugins: Given the history of vulnerabilities, users may evaluate other plugins that provide similar functionalities but with a stronger security track record.
  • Regular Security Audits: Conduct regular security checks and updates to ensure no other vulnerabilities are present.

Previous Vulnerabilities

Since January 11, 2023, there have been two other reported vulnerabilities in the WP Show Posts plugin, emphasizing the need for ongoing vigilance and proactive security measures.


The prompt resolution of CVE-2023-6731 by the WP Show Posts developers illustrates the critical nature of timely software updates in safeguarding WordPress sites against potential threats. For small business owners, actively managing WordPress site security through regular updates, monitoring security advisories, and understanding the implications of vulnerabilities are indispensable practices. These steps are not just about protecting data—they are about safeguarding the business's online presence and maintaining the trust of its users.

Staying ahead of vulnerabilities requires not only attention but also an understanding of the security landscape. For a small business owner, integrating simple yet effective security measures into regular website maintenance can prevent potential crises and foster a secure growth environment.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WP Show Posts Vulnerability – Improper Authorization to Information Exposure – CVE-2023-6731 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment