CVE-2013-10007: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: A vulnerability classified as problematic has been found in ethitter WP-Print-Friendly up to 0.5.2. This affects an unknown part of the file wp-print-friendly.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. Upgrading to version 0.5.3 is able to address this issue. The identifier of the patch is 437787292670c20b4abe20160ebbe8428187f2b4. It is recommended to upgrade the affected component. The identifier VDB-217269 was assigned to this vulnerability.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2023-01-03T11:15Z
Repository: https://github.com/ethitter/WP-Print-Friendly
Language: PHP
Files changed: readme.txt, wp-print-friendly.php
Commit date: 2013-04-30 19:29:52 -0400
Commit message: Version 0.5.3 - Security Update

Security Update
* Correct security vulnerability allowing both private and password protected posts from being accessed through the print page
* Creates is_protected() method to determine if the print page should be visible to the current user
* Remove print_url links from the content when the current user does not have the necessary capabilities to view the print page
ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss

Diff: diff --git a/readme.txt b/readme.txt
index 8d54ed8..cf16fda 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,12 +1,12 @@
 === WP Print Friendly ===
-Contributors: ethitter, thinkoomph
+Contributors: ethitter, stevenkword, thinkoomph
 Donate link: http://www.thinkoomph.com/plugins-modules/wp-print-friendly/
 Tags: print, template, printer, printable
 Requires at least: 3.1
 Tested up to: 3.5
-Stable tag: 0.5.2
+Stable tag: 0.5.3
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
 Extends WordPress' template system to support printer-friendly templates. Works with permalink structures to support nice URLs.
 
@@ -57,10 +57,15 @@ This plugin is known to conflict with certain plugins, many pertaining to SEO an
 
 * **WordPress SEO by Yoast:** This plugin's `Permalink` options, particularly *Redirect attachment URL's to parent post URL* and *Redirect ugly URL's to clean permalinks. (Not recommended in many cases!)*, interfere with WP Print Friendly's ability to display print templates. Both must be disabled, and the site's rewrite rules regenerated (by visiting Options > Permalinks and clicking *Save Changes*), for WP Print Friendly to function.
 
 == Changelog ==
 
+= 0.5.3 =
+* Creates is_protected() method to determine if the print page should be visible to the current user
+* Correct security vulnerability allowing both private and password protected posts from being accessed through the print page
+* Remove print_url links from the content when the current user does not have the necessary capabilities to view the print page
+
 = 0.5.2 =
 * Revert change in is_print() method made in version 0.5 as it breaks the method when no page number is specified. See [https://github.com/ethitter/WP-Print-Friendly/issues/2](https://github.com/ethitter/WP-Print-Friendly/issues/2).
 
 = 0.5.1 =
 * Correct construction of query needed in situations where verbose page rules are required.
@@ -172,6 +177,6 @@ This release expands the plugin's page rewrite rules to accomodate permalink str
 
 = 0.4.1 =
 This release fixes bug that displayed post links automatically on the wrong post types.
 
 = 0.4 =
-This release addresses numerous bugs reported by the community, including print templates for child pages. All admin text, save the plugin's name, are now ready for translation. Templates are now completely customizable, and new template functions are included.
\ No newline at end of file
+This release addresses numerous bugs reported by the community, including print templates for child pages. All admin text, save the plugin's name, are now ready for translation. Templates are now completely customizable, and new template functions are included.
diff --git a/wp-print-friendly.php b/wp-print-friendly.php
index 8551331..700f807 100644
--- a/wp-print-friendly.php
+++ b/wp-print-friendly.php
@@ -1,12 +1,12 @@
 <?php
 /*
 Plugin Name: WP Print Friendly
 Plugin URI: http://www.thinkoomph.com/plugins-modules/wp-print-friendly/
 Description: Extends WordPress' template system to support printer-friendly templates. Works with permalink structures to support nice URLs.
-Author: Erick Hitter & Oomph, Inc.
-Version: 0.5.2
+Author: Erick Hitter, Steven K Word & Oomph, Inc.
+Version: 0.5.3
 Author URI: http://www.thinkoomph.com/
 
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
@@ -78,10 +78,11 @@ class wp_print_friendly {
 		add_action( 'init', array( $this, 'action_init' ), 20 );
 		add_action( 'admin_init', array( $this, 'action_admin_init' ) );
 		add_action( 'admin_menu', array( $this, 'action_admin_menu' ) );
 		add_filter( 'request', array( $this, 'filter_request' ) );
 		add_action( 'pre_get_posts', array( $this, 'action_pre_get_posts' ) );
+		add_action( 'wp', array( $this, 'action_wp' ) );
 		add_filter( 'template_include', array( $this, 'filter_template_include' ) );
 		add_filter( 'redirect_canonical', array( $this, 'filter_redirect_canonical' ) );
 		add_filter( 'body_class', array( $this, 'filter_body_class' ) );
 		add_filter( 'the_content', array( $this, 'filter_the_content' ), 0 );
 		add_filter( 'the_content', array( $this, 'filter_the_content_auto' ) );
@@ -159,10 +160,27 @@ class wp_print_friendly {
 
 		if ( isset( $_GET[ $this->notice_key ] ) )
 			update_option( $this->notice_key, 1 );
 	}
 
+	/**
+	 * Determine if the print page should be visible to the current user
+	 *
+	 * @uses current_user_can, post_password_required
+	 * @global $wp_query, $post
+	 * @return bool
+	 */
+	public function is_protected() {
+		global $post;
+
+		// If the global $post object is not set OR BOTH the current user is NOT an admin AND the post is private
+		$private = ( ! isset( $post ) || ( ! current_user_can( 'read_private_posts' ) && 'private' == $post->post_status ) ) ? true : false;
+
+		// If the password is required OR if the current user does not have the capability to view private posts
+		return post_password_required() || true === $private;
+	}
+
 	/**
 	 * Determine if print template is being requested.
 	 *
 	 * @global $wp_query
 	 * @return bool
@@ -271,19 +289,38 @@ class wp_print_friendly {
 		}
 
 		return $query;
 	}
 
+	/**
+	 * Throw a 404 if the print page should not be visible to the user
+	 *
+	 * @action wp
+	 * @global $wp_query
+	 * @uses $this::is_print, $this::is_protected
+	 * @return null
+	 */
+	function action_wp() {
+		global $wp_query;
+
+		if( $this->is_print() && $this->is_protected() ) {
+			$wp_query->set_404();
+			status_header( 404 );
+			nocache_headers();
+		}
+	}
+
 	/**
 	 * Filter template include to return print template if requested.
 	 *
 	 * @param string $template
 	 * @filter template_include
+	 * @uses this::is_protected
 	 * @return string
 	 */
 	public function filter_template_include( $template ) {
-		if ( $this->is_print() && ( $print_template = $this->template_chooser() ) )
+		if ( $this->is_print() && ! $this->is_protected() && ( $print_template = $this->template_chooser() ) )
 			$template = $print_template[ 'path' ];
 
 		return $template;
 	}
 
@@ -348,19 +385,23 @@ class wp_print_friendly {
 
 	/**
 	 * Filter the content if automatic inclusion is selected.
 	 *
 	 * @param string $content
-	 * @uses $this::get_options, $post, $this::print_url, get_query_var, apply_filters
+	 * @uses $this::get_options, $post, $this::print_url, $this::is_protected, get_query_var, apply_filters
 	 * @filter the_content
 	 * @return string
 	 */
 	public function filter_the_content_auto( $content ) {
 		$options = $this->get_options();
 
 		global $post;
 
+		// Do not display the print_url link if the print page is not be accessible to the user
+		if( $this->is_protected() )
+			return $content;
+
 		if ( is_array( $options ) && array_key_exists( 'auto', $options ) && $options[ 'auto' ] == true && in_array( $post->post_type, $options[ 'post_types' ] ) && ! $this->is_print() ) {
 			extract( $options );
 
 			//Basic URL
 			$print_url = $this->print_url();
@@ -926,6 +967,6 @@ if ( ! function_exists( 'is_print' ) ) {
 			$wpf = new wp_print_friendly;
 
 		return $wpf->is_print();
 	}
 }
-?>
\ No newline at end of file
+?>

Vulnerable code: Contributors: ethitter, thinkoomph
Stable tag: 0.5.2
This release addresses numerous bugs reported by the community, including print templates for child pages. All admin text, save the plugin's name, are now ready for translation. Templates are now completely customizable, and new template functions are included.
Author: Erick Hitter & Oomph, Inc.
Version: 0.5.2
		if ( $this->is_print() && ( $print_template = $this->template_chooser() ) )
	 * @uses $this::get_options, $post, $this::print_url, get_query_var, apply_filters
?>
Fixed code: Contributors: ethitter, stevenkword, thinkoomph
Stable tag: 0.5.3
= 0.5.3 =
* Creates is_protected() method to determine if the print page should be visible to the current user
* Correct security vulnerability allowing both private and password protected posts from being accessed through the print page
* Remove print_url links from the content when the current user does not have the necessary capabilities to view the print page

This release addresses numerous bugs reported by the community, including print templates for child pages. All admin text, save the plugin's name, are now ready for translation. Templates are now completely customizable, and new template functions are included.
Author: Erick Hitter, Steven K Word & Oomph, Inc.
Version: 0.5.3
		add_action( 'wp', array( $this, 'action_wp' ) );
	/**
	 * Determine if the print page should be visible to the current user
	 *
	 * @uses current_user_can, post_password_required
	 * @global $wp_query, $post
	 * @return bool
	 */
	public function is_protected() {
		global $post;

		// If the global $post object is not set OR BOTH the current user is NOT an admin AND the post is private
		$private = ( ! isset( $post ) || ( ! current_user_can( 'read_private_posts' ) && 'private' == $post->post_status ) ) ? true : false;

		// If the password is required OR if the current user does not have the capability to view private posts
		return post_password_required() || true === $private;
	}

	/**
	 * Throw a 404 if the print page should not be visible to the user
	 *
	 * @action wp
	 * @global $wp_query
	 * @uses $this::is_print, $this::is_protected
	 * @return null
	 */
	function action_wp() {
		global $wp_query;

		if( $this->is_print() && $this->is_protected() ) {
			$wp_query->set_404();
			status_header( 404 );
			nocache_headers();
		}
	}

	 * @uses this::is_protected
		if ( $this->is_print() && ! $this->is_protected() && ( $print_template = $this->template_chooser() ) )
	 * @uses $this::get_options, $post, $this::print_url, $this::is_protected, get_query_var, apply_filters
		// Do not display the print_url link if the print page is not be accessible to the user
		if( $this->is_protected() )
			return $content;

?>