With displayExcerpt set to full content, render_block_core_latest_comments() rendered get_comment_text() for every recent comment regardless of the parent post’s protection state, so any unauthenticated visitor could read the discussion on a password-protected post from the block output. The fix checks post_password_required( $comment->comment_post_ID ) and substitutes the “Password protected” placeholder instead of the comment body. (The excerpt branch already went through get_comment_excerpt(), which performs its own check.)
This vulnerability affects the following application versions:
- WordPress 7.0
- WordPress 7.0.1
- WordPress 7.0.2