The vulnerability in the Animated Text Block plugin allows an authenticated user with Contributor role or higher to retrieve the rendered content of any published post by supplying its identifier through the "animated-text" shortcode. The plugin’s handler fetches the post without checking user capabilities or confirming that the post type is the plugin’s own custom post type, and then displays the content. This omission enables the exfiltration of content from private custom post types that would normally be inaccessible via direct URLs or the REST API.

WordPress sites running the bplugins Animated Text Block plugin Version 1.2.6 or earlier are affected. The flaw is present in the plugin's shortcode handler and impacts all sites where the plugin is activated and the vulnerable shortcode is used in post content.

The CVSS score of 7.5 indicates a high severity of sensitive information exposure. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, suggesting it is not widely exploited at this time. The attack requires authenticated access at Contributor level or higher and depends on the presence of the shortcode in post content. Once executed, the attacker can read content from private posts that should otherwise be protected by WordPress’s visibility controls.