CVE-2023-0749: Oceanwp Ocean Extra

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.

Affected products

• Oceanwp Ocean Extra: before 2.1.3 (fixed in 2.1.3)

Published 2023-03-13. Last modified 2026-06-17.