CVE-2023-1911: 
WordPress vulnerability analysis and mitigation

The Blocksy Companion WordPress plugin before version 1.8.82 contains a vulnerability identified as CVE-2023-1911. This security flaw allows authenticated users with subscriber-level access to view draft posts that should not be publicly accessible. The vulnerability was discovered and publicly disclosed on April 10, 2023 (WPScan).

The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue with a CVSS score of 6.5 (medium). The security flaw exists because the plugin does not properly verify whether posts accessed via a shortcode are public and viewable. This falls under the OWASP Top 10 category A5: Broken Access Control and is identified as CWE-639 (WPScan).

When exploited, this vulnerability allows any authenticated user, including those with minimal subscriber privileges, to access and view draft posts that should be restricted. This represents a breach of content access controls and could expose sensitive or unpublished information (WPScan).

The vulnerability has been fixed in Blocksy Companion version 1.8.82. Site administrators are advised to update to this version or later to protect against unauthorized access to draft posts (WPScan).