CVE-2024-13430

The Pagelayer page builder plugin for WordPress contains an information disclosure flaw affecting versions 1.9.8 and earlier in the pagelayer_builder_posts_shortcode function. Authenticated users with Contributor permissions or higher can bypass access controls to retrieve content from private posts they are not authorized to view. The vulnerability stems from inadequate validation of which posts can be accessed through this function. Users should update to version 1.9.9 or later to remediate this issue.

Based on public CVE data (MITRE/NVD).