We are releasing an update related to the Broken Access Control issue reported some time ago.
This is a relatively minor issue. It could only expose data from Pages that are not public, and only in cases where a rogue Contributor attempted to access draft pages.
The patch has been delayed for two reasons:
- The issue would not allow your website to be hacked (unless you are storing sensitive information like logins and passwords inside draft Pages in wp-admin → Pages).
- Fixing it requires a backward-incompatible change.
How do I know if my website is affected?
Good question.
- Go to wp-admin → Pages
- Search for:
adverts_block
If no results are found, your website is not affected, and you can safely update the plugin.
If results are found, you have two options:
Option 1 (Simplest Solution)
If you are the only person with access to wp-admin or you trust all users who have access to wp-admin
Add the following line to your theme’s functions.php file. This will restore the ability to use draft pages as templates for the [adverts_block] shortcode:
add_filter( "wpadverts_allow_draft_templates", "__return_true" );Option 2 (More Secure Solution)
This option requires some manual work and is recommended if: you have Contributors on your site or you do not fully trust all users with wp-admin access
Steps:
- From wp-admin → Pages panel search for “adverts_page” to reveal all pages using this shortcode.
- Edit each Page that contains the
[adverts_block]shortcode. - Check which template the shortcode is using.
- Go to wp-admin → Pages and open that template.
- If the template’s status is anything other than Published, change it to Published.
The [adverts_block] shortcode will now be able to load templates correctly again.