| Package | Affected versions | Patched versions |
|---|---|---|
| ocean extra | < 2.1.3 | 2.1.3 |
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free