Segurium Research Advisories gutentor

Gutentor 4.0.5 and earlier: Missing capability check

high Missing capability check

Gutentor 4.0.6 adds capability checks to its own REST API. Version 4.0.5 and earlier returned non-public post content and the plain post_password value, and let callers filter posts by password. About 30,000 sites run the plugin.

Plugin
Gutentor gutentor
Affected versions
4.0.5 and earlier
Fixed in
4.0.6
Class
Missing capability check
Severity
high Segurium Research assessment. No CVSS score published yet.
CVE
None assigned at the time of writing
Installs
30,000 active
Patch released
Sources
Read the teardown What the release changed, how the bug worked, and what to check on a site that ran the affected version.

Segurium Research writes these up from public source after the fix has shipped. We do not scan or probe third-party sites, and no teardown here carries a working exploit. Segurium itself is a WordPress malware scanner on the official directory at wordpress.org/plugins/segurium/.