Executive brief
The 24liveblog plugin for WordPress, which allows users to embed live blogs on their websites, contains a security flaw that exposes sensitive account credentials. An attacker with basic contributor-level access to the website can view the site's 24liveblog API tokens and account details. This could allow an unauthorized person to access or manage the site owner's 24liveblog account.
Technical details
The vulnerability is classified as an Exposure of Sensitive Information (CWE-200) within the lb24_block_enqueue_scripts() function. This function is hooked to enqueue_block_editor_assets and incorrectly falls back to loading administrator-configured site-wide secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) for non-administrator users. These secrets are retrieved from the options table via get_option() and emitted into the page source via wp_localize_script() as the lb24BlockData JavaScript object. Authenticated attackers with contributor-level access or higher can extract these credentials by inspecting the page source while using the block editor.
Affected products
- 24liveblog 24liveblog – live blog tool up to, and including, 2.2
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory