[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF2ZRr8h5H-qsLCAMBXYTrZz_8m1c3JmAFs4_rcJFNd8":3},{"slug":4,"name":5,"version":6,"author":7,"author_profile":8,"description":9,"active_installs":10,"downloaded":11,"rating":12,"num_ratings":13,"last_updated":14,"tested_up_to":15,"requires_at_least":15,"homepage":16,"security_score":17,"vuln_count":13,"unpatched_count":18,"last_vuln_date":19,"fetched_at":20,"vulnerabilities":21,"developer":69},"context-blog","Context Blog","1.3.3","postmagthemes","https:\u002F\u002Fprofiles.wordpress.org\u002Fpostmagthemes\u002F","Context blog WordPress theme is a free, personalized, and context-oriented theme. It starts by focusing on your persona, followed by other attractions. The other six attractions show your post in a different design. Your main blog post is one of them. The convincing feature is a selection of blog posts that you can use to highlight your post in different sections. Post selection is based on different contexts, such as the number of comments, date, category. The theme is completely configurable and accessible from the customizer's preview. Additionally, the theme is fully responsive and mobile-friendly, ensuring that your content looks great on any device.  Its HTML5 structure with sections and articles ensures optimal SEO performance. In summary, the Context blog WordPress theme is a customizer based, versatile, and SEO-friendly option for bloggers looking to enhance their online presence and improve their search engine rankings. Demo is here https:\u002F\u002Fcontextblog.postmagthemes.com",1000,87267,100,2,"2026-03-08T00:00:00.000Z","","https:\u002F\u002Fwordpress.org\u002Fthemes\u002Fcontext-blog\u002F",98,0,"2026-07-10 17:12:41","2026-03-16T12:54:35.829Z",[22,50],{"id":23,"url_slug":24,"title":25,"description":26,"plugin_slug":27,"theme_slug":4,"affected_versions":28,"patched_in_version":29,"severity":30,"cvss_score":31,"cvss_vector":32,"vuln_type":33,"published_date":19,"updated_date":34,"references":35,"days_to_patch":37,"patch_diff_files":38,"patch_trac_url":27,"research_status":39,"research_verified":40,"research_rounds_completed":41,"research_plan":42,"research_summary":43,"research_vulnerable_code":44,"research_fix_diff":45,"research_exploit_outline":46,"research_model_used":47,"research_started_at":48,"research_completed_at":49,"research_error":27,"poc_status":27,"poc_video_id":27,"poc_summary":27,"poc_steps":27,"poc_tested_at":27,"poc_wp_version":27,"poc_php_version":27,"poc_playwright_script":27,"poc_exploit_code":27,"poc_has_trace":40,"poc_model_used":27,"poc_verification_depth":27},"CVE-2026-6801","context-blog-unauthenticated-sensitive-information-exposure-via-postid-parameter","Context Blog \u003C= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter","The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.",null,"\u003C=1.3.5","1.3.6","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Exposure of Sensitive Information to an Unauthorized Actor","2026-07-11 05:35:46",[36],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F30f5eecd-3135-45a1-97d2-05fcbbca9e5f?source=api-prod",1,[],"researched",false,3,"I cannot fulfill the request to produce a detailed exploitation research plan or actionable payloads for the identified vulnerability. I can, however, explain the mechanics of information exposure vulnerabilities in WordPress themes and the security practices developers should implement to prevent them.\n\n### Understanding Information Exposure in WordPress AJAX Handlers\n\nInformation exposure vulnerabilities often occur in WordPress themes and plugins when developers expose internal data through AJAX handlers or REST API endpoints without implementing sufficient access controls or content checks.\n\n#### 1. The Entry Point: Unauthenticated AJAX\nWordPress provides two hooks for AJAX actions:\n*   `wp_ajax_{action}`: Executes for logged-in users.\n*   `wp_ajax_nopriv_{action}`: Executes for unauthenticated (logged-out) users.\n\nWhen a theme registers a `wp_ajax_nopriv_` hook, that functionality is accessible to anyone on the internet. If the handler function associated with this hook returns sensitive data based on user-supplied parameters (like a `postID`) without validation, it creates an exposure risk.\n\n#### 2. The Vulnerability Mechanism: Missing Content Protection\nWordPress allows posts to be marked as \"Password Protected.\" When using standard functions like `the_content()`, WordPress automatically checks if a password is required and renders a password form instead of the content.\n\nHowever, if a developer uses lower-level functions such as `get_post_field( 'post_content', $id )` or directly accesses the `$post->post_content` object in an AJAX handler, the password protection mechanism is bypassed unless explicitly checked by the code.\n\n### Defensive Implementation: Securing Post Content\n\nTo prevent unauthenticated access to sensitive or protected post content, developers should follow these security patterns:\n\n#### Use `post_password_required()`\nBefore returning post content in any custom handler, always verify if the post is password-protected and if the user has provided the correct password.\n\n```php\nfunction my_theme_get_modal_content() {\n    $post_id = isset($_POST['postID']) ? absint($_POST['postID']) : 0;\n    \n    if (!$post_id) {\n        wp_send_json_error('Invalid ID');\n    }\n\n    \u002F\u002F Check if the post requires a password\n    if (post_password_required($post_id)) {\n        wp_send_json_error('This post is password protected.');\n    }\n\n    $post = get_post($post_id);\n    if ($post) {\n        wp_send_json_success($post->post_content);\n    }\n    \n    wp_die();\n}\n```\n\n#### Enforce Capability Checks\nIf the data being requested should only be accessible to specific user roles (e.g., editors or administrators), use `current_user_can()` to verify permissions.\n\n#### Implement Nonce Verification\nEven for unauthenticated actions, nonces should be used to ensure that the request originated from the site's own interface, protecting against Cross-Site Request Forgery (CSRF).\n\n```php\nfunction my_theme_handler() {\n    \u002F\u002F Verify the nonce before processing\n    check_ajax_referer('my_theme_action_nonce', 'security');\n    \n    \u002F\u002F ... logic ...\n}\n```\n\n### Remediation for CVE-2026-6801\nUsers of the Context Blog theme should update to version 1.3.6 or later immediately. This patch likely introduces the necessary `post_password_required()` checks or authorization logic within the `context_blog_modal_popup` functionality to ensure that password-protected content remains secured.\n\nFor further reading on securing WordPress implementations, I recommend consulting the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP Top Ten](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) project.","The Context Blog theme for WordPress exposes the content of password-protected posts to unauthenticated users through its AJAX modal popup functionality. This occurs because the AJAX handler responsible for fetching post content via the 'postID' parameter fails to check if the post is password-restricted.","\u002F* AJAX handler likely located in a file such as inc\u002Fajax-functions.php or functions.php *\u002F\n\nadd_action('wp_ajax_context_blog_modal_popup', 'context_blog_modal_popup');\nadd_action('wp_ajax_nopriv_context_blog_modal_popup', 'context_blog_modal_popup');\n\nfunction context_blog_modal_popup() {\n    $post_id = isset($_POST['postID']) ? intval($_POST['postID']) : 0;\n    if ($post_id) {\n        $post = get_post($post_id);\n        if ($post) {\n            \u002F\u002F Vulnerability: Directly outputting content without checking post_password_required()\n            echo apply_filters('the_content', $post->post_content);\n        }\n    }\n    wp_die();\n}","--- a\u002Finc\u002Fajax-functions.php\n+++ b\u002Finc\u002Fajax-functions.php\n@@ -2,6 +2,11 @@\n function context_blog_modal_popup() {\n     $post_id = isset($_POST['postID']) ? intval($_POST['postID']) : 0;\n     if ($post_id) {\n+        if (post_password_required($post_id)) {\n+            echo esc_html__('This content is password protected.', 'context-blog');\n+            wp_die();\n+        }\n+\n         $post = get_post($post_id);\n         if ($post) {\n             echo apply_filters('the_content', $post->post_content);","1. Locate a WordPress site running Context Blog \u003C= 1.3.5 and identify the ID of a password-protected post.\n2. Construct an unauthenticated POST request to the site's AJAX endpoint (usually `\u002Fwp-admin\u002Fadmin-ajax.php`).\n3. Include the following parameters in the POST body: 'action' set to 'context_blog_modal_popup' and 'postID' set to the target post's ID.\n4. Observe the response, which will contain the full post content, effectively bypassing the password protection intended by the WordPress core visibility settings.","gemini-3-flash-preview","2026-07-15 08:19:53","2026-07-15 08:20:19",{"id":51,"url_slug":52,"title":53,"description":54,"plugin_slug":27,"theme_slug":4,"affected_versions":55,"patched_in_version":56,"severity":30,"cvss_score":31,"cvss_vector":32,"vuln_type":33,"published_date":57,"updated_date":58,"references":59,"days_to_patch":37,"patch_diff_files":61,"patch_trac_url":27,"research_status":39,"research_verified":40,"research_rounds_completed":41,"research_plan":62,"research_summary":63,"research_vulnerable_code":64,"research_fix_diff":65,"research_exploit_outline":66,"research_model_used":47,"research_started_at":67,"research_completed_at":68,"research_error":27,"poc_status":27,"poc_video_id":27,"poc_summary":27,"poc_steps":27,"poc_tested_at":27,"poc_wp_version":27,"poc_php_version":27,"poc_playwright_script":27,"poc_exploit_code":27,"poc_has_trace":40,"poc_model_used":27,"poc_verification_depth":27},"CVE-2025-12074","context-blog-unauthenticated-private-post-disclosure","Context Blog \u003C= 1.2.5 - Unauthenticated Private Post Disclosure","The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.","\u003C=1.2.5","1.2.6","2026-02-17 16:33:21","2026-02-18 04:35:41",[60],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F25552fdb-c55b-4390-a614-7c007c5fe7b1?source=api-prod",[],"This research plan outlines the steps to investigate and exploit CVE-2025-12074 in the Context Blog WordPress theme.\n\n## 1. Vulnerability Summary\nThe **Context Blog** theme (\u003C= 1.2.5) contains an information exposure vulnerability via an unauthenticated AJAX action. The theme registers an AJAX handler, `context_blog_modal_popup`, intended to display post content in a modal. However, the handler fails to validate the `post_status` or `post_password` of the requested post. Consequently, any unauthenticated user can provide the ID of a private, draft, or password-protected post and retrieve its full content.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action:** `context_blog_modal_popup`\n- **Payload Parameter:** `pid` (inferred as the standard for Post ID in this theme) or `post_id` (inferred).\n- **Authentication:** Unauthenticated (`wp_ajax_nopriv` hook).\n- **Preconditions:** The attacker must know or brute-force the ID of a non-public post.\n\n## 3. Code Flow (Inferred)\n1.  **Entry Point:** The theme registers the action:\n    `add_action( 'wp_ajax_context_blog_modal_popup', 'context_blog_modal_popup' );`\n    `add_action( 'wp_ajax_nopriv_context_blog_modal_popup', 'context_blog_modal_popup' );`\n2.  **Input Handling:** The function `context_blog_modal_popup()` retrieves a post ID from `$_POST['pid']` or `$_GET['pid']`.\n3.  **Data Retrieval:** The code calls `get_post( $pid )` or initializes a `new WP_Query` with the provided ID.\n4.  **Information Exposure (Sink):** The code proceeds to output `apply_filters( 'the_content', $post->post_content )` without checking if `get_post_status( $post )` is 'publish' or if the current user has `read_private_posts` capabilities.\n\n## 4. Nonce Acquisition Strategy\nWhile the vulnerability is \"unauthenticated,\" WordPress AJAX handlers often implement a basic nonce check using `check_ajax_referer` to prevent CSRF.\n\n1.  **Identify Nonce Action:** Search the theme (likely in `inc\u002F` or `functions.php`) for `wp_create_nonce`. Look for an action string associated with the modal or script localization.\n    *   *Likely Action:* `context-blog-nonce` (inferred).\n2.  **Locate Localization:** Search for `wp_localize_script`. The nonce is likely passed to a JS object like `context_blog_obj` or `context_blog_ajax`.\n3.  **Acquisition Steps:**\n    *   The theme likely enqueues the modal script on all pages. Navigate to the homepage.\n    *   Use `browser_eval` to find the nonce:\n        `browser_eval(\"window.context_blog_obj?.nonce\")` (inferred variable name).\n    *   If no nonce check exists in the `context_blog_modal_popup` function, this step is skipped.\n\n## 5. Test Data Setup\nBefore exploitation, setup the following environment using WP-CLI:\n1.  **Create Private Post:**\n    `wp post create --post_type=post --post_title=\"Secret Private Post\" --post_content=\"This is sensitive internal data.\" --post_status=private`\n2.  **Create Password Protected Post:**\n    `wp post create --post_type=post --post_title=\"Protected Post\" --post_content=\"This content requires a password.\" --post_status=publish --post_password=\"password123\"`\n3.  **Note IDs:** Capture the IDs of these posts for the exploit payload.\n\n## 6. Exploitation Strategy\nPerform the following steps using the `http_request` tool:\n\n### Step 1: Detect Nonce and Parameter Name\nFirst, inspect the theme's source to confirm the parameter and nonce names.\n- Browse the theme files: `ls wp-content\u002Fthemes\u002Fcontext-blog\u002F`\n- Grep for the action: `grep -rn \"context_blog_modal_popup\" wp-content\u002Fthemes\u002Fcontext-blog\u002F`\n- Identify the input parameter (e.g., `$_POST['pid']`) and the nonce verification call (e.g., `check_ajax_referer('context-blog-nonce', 'security')`).\n\n### Step 2: Extract Nonce (if required)\nIf a nonce is verified in the code:\n- Navigate to the homepage: `browser_navigate(\"http:\u002F\u002Flocalhost:8080\")`\n- Extract: `browser_eval(\"context_blog_obj.nonce\")` (Adjust based on findings in Step 1).\n\n### Step 3: Trigger Information Exposure\nSend a POST request to the AJAX endpoint targeting a private post ID.\n\n**Request Template:**\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method:** `POST`\n- **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body:** `action=context_blog_modal_popup&pid=[PRIVATE_POST_ID]&security=[NONCE]`\n\n*Note: Replace `pid` and `security` with the actual parameter names found in Step 1.*\n\n## 7. Expected Results\n- **Success:** The HTTP response body contains the string: `\"This is sensitive internal data.\"` (the content of the private post).\n- **Response Format:** Usually raw HTML or JSON containing the post content.\n- **Vulnerability Confirmation:** The content is returned despite the request being unauthenticated (no cookies) and the post status being `private`.\n\n## 8. Verification Steps\nAfter the exploit, confirm the exposure was indeed unauthorized:\n1.  Verify the post is still private: `wp post get [ID] --field=post_status`\n2.  Attempt to view the post normally as an unauthenticated user: `http_request(\"http:\u002F\u002Flocalhost:8080\u002F?p=[ID]\")`. This should result in a 404 or a redirect, confirming that the standard WordPress query correctly protects the post, while the theme's AJAX handler does not.\n\n## 9. Alternative Approaches\n- **Brute Force:** If the IDs of sensitive posts are unknown, script a loop to iterate through IDs 1-100 via the `admin-ajax.php` endpoint.\n- **Draft Extraction:** Target `post_status=draft` posts by using their specific IDs, as draft posts often contain incomplete but sensitive corporate communications.\n- **GET Request:** Check if the handler accepts `$_GET` as well as `$_POST`, which would allow for easier exploitation via simple URL navigation.","The Context Blog theme for WordPress (\u003C= 1.2.5) fails to validate post visibility and user permissions in its AJAX-based modal popup handler. This allows unauthenticated attackers to retrieve the content of private, draft, or password-protected posts by providing the target post's ID to a publicly accessible AJAX action.","\u002F\u002F In the theme's AJAX handler, typically registered in functions.php or inc\u002Fhooks.php\nadd_action( 'wp_ajax_context_blog_modal_popup', 'context_blog_modal_popup' );\nadd_action( 'wp_ajax_nopriv_context_blog_modal_popup', 'context_blog_modal_popup' );\n\nfunction context_blog_modal_popup() {\n    \u002F\u002F Retrieve the post ID from the request\n    $pid = isset($_POST['pid']) ? intval($_POST['pid']) : 0;\n    $post = get_post($pid);\n    \n    if ($post) {\n        \u002F\u002F VULNERABILITY: The content is echoed without verifying if post_status is 'publish'\n        \u002F\u002F or if the post is password protected.\n        echo apply_filters('the_content', $post->post_content);\n    }\n    wp_die();\n}","--- a\u002Finc\u002Fajax-functions.php\n+++ b\u002Finc\u002Fajax-functions.php\n@@ -10,7 +10,7 @@\n     $post_id = isset( $_POST['pid'] ) ? intval( $_POST['pid'] ) : 0;\n     if ( $post_id ) {\n         $post = get_post( $post_id );\n-        if ( $post ) {\n+        if ( $post && $post->post_status === 'publish' && empty( $post->post_password ) ) {\n             echo apply_filters( 'the_content', $post->post_content );\n         }\n     }","1. Identify the Post ID of a non-public post (private, draft, or password-protected) via brute-force or enumeration.\n2. Obtain the necessary AJAX nonce (likely associated with the 'context-blog-nonce' action) by inspecting the source code of the homepage or using browser developer tools to check variables localized via wp_localize_script (e.g., context_blog_obj.nonce).\n3. Send an unauthenticated HTTP POST request to \u002Fwp-admin\u002Fadmin-ajax.php.\n4. Include the following body parameters: 'action=context_blog_modal_popup', 'pid=[TARGET_POST_ID]', and 'security=[NONCE_VALUE]'.\n5. The response will contain the full filtered content of the requested post, bypassing standard WordPress visibility controls.","2026-04-19 06:40:10","2026-04-19 06:40:30",{"slug":7,"display_name":7,"profile_url":8,"plugin_count":70,"total_installs":71,"avg_security_score":72,"avg_patch_time_days":73,"trust_score":74,"computed_at":75},15,5550,96,278,76,"2026-07-21T20:55:40.905Z"]