CVE-2026-109979 in Related Posts Plugin
Summary
by MITRE • 10/28/2026
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map('get_post', $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child->post_title) in the parent's editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Related Posts for WordPress plugin versions up to 3.0.0 represents a critical flaw in access control logic that leads to sensitive information exposure. This issue stems from an improper implementation of authorization checks within the administrative interface, specifically affecting the rp4wp_create_link parameter on the hidden rp4wp_link_related admin page. While the application correctly verifies nonces and confirms that the current user has permission to edit the parent post, it fails to validate whether the attacker-supplied child post ID corresponds to a resource the requesting user is authorized to view. This oversight allows authenticated attackers with Contributor-level access or higher to bypass standard WordPress capability checks regarding private content visibility.
The technical root cause lies in the LinkRepository::insert() function and its interaction with ManageLinks::render(). When an attacker submits a request containing an arbitrary child post ID, the system stores this identifier without performing any validation against the user's read permissions. Subsequently, when rendering the meta box for the parent post editor, the application invokes LinkRepository::get_children() in a fast path mode that bypasses additional argument checks. This function executes array_map('get_post', $child_ids), which retrieves full post objects including titles without enforcing the read_private_posts or read_post capabilities typically required to access non-public content such as drafts, pending reviews, private posts, future scheduled posts, or even trashed items authored by higher-privileged users. The retrieved title is then echoed directly into the editor interface using esc_html(), resulting in a reflected disclosure of sensitive metadata.
From an operational perspective, this vulnerability enables authenticated attackers to enumerate and read titles of arbitrary non-public posts within the WordPress installation. Although the attacker cannot modify or delete content, the ability to view titles of private drafts or pending articles can provide significant intelligence for further attacks. For instance, knowing that a specific draft exists may indicate upcoming product launches, internal communications, or security configurations before they are publicly released. This information leakage aids adversaries in crafting more targeted social engineering campaigns or identifying high-value targets within the organization's digital infrastructure. The impact is particularly severe because it requires only Contributor-level access, which is often granted to content creators who should not have visibility into administrative or sensitive editorial workflows.
This vulnerability aligns with CWE-200: Information Exposure and CWE-862: Missing Authorization, as the application fails to enforce proper access controls on a protected resource. In terms of the MITRE ATT&CK framework for enterprise environments, this behavior corresponds to T1005: Data from Local System Retrieval, where an attacker gathers information directly from compromised systems or applications without executing malicious code. The attack vector is classified as local with low complexity due to the requirement for authentication and specific user roles, yet it poses a significant risk in multi-user WordPress environments where privilege escalation chains may be constructed using this initial foothold.
Mitigation strategies should prioritize immediate updates to version 3.0.1 or later of the Related Posts plugin, which addresses these authorization gaps by implementing proper capability checks before retrieving post data. Administrators running vulnerable versions must restrict access to the rp4wp_link_related admin page and ensure that only users with Editor-level privileges or higher can interact with related posts functionality until patches are applied. Additionally, enforcing strict role-based access control policies within WordPress helps limit the blast radius of such vulnerabilities by ensuring that lower-privileged accounts do not have unnecessary administrative capabilities. Regular security audits focusing on authorization logic in custom plugins and third-party extensions are essential to prevent similar information disclosure flaws from persisting in production environments.