Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access

The Ocean Extra for WordPress is vulnerable to disclosure of potentially sensitive data in versions up to, and including, 2.1.2. This is due to to the [oceanwp_library] shortcode not properly validating a post's status prior to returning the post's content. This makes it possible for authenticated attackers with subscriber-level permissions and above to retrieve arbitrary post content, even when it is in a pre-published or private status.