CVE-2026-109980 in Related Posts Plugin
Summary
by MITRE • 10/28/2026
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Related Posts for WordPress plugin affects all versions up to 3.0.0 and represents a critical failure in access control mechanisms designed to protect sensitive content. This flaw allows authenticated attackers with contributor-level permissions or higher to bypass intended restrictions on viewing private posts. The core issue lies within the handling of the rp4wp_view parameter, which is processed without adequate verification of post ownership or appropriate privilege levels for accessing restricted data. In a standard WordPress environment, private posts are typically visible only to users with editor-level access and above, ensuring that content marked as private remains confidential from lower-tier contributors who may have broader editing capabilities but not full administrative oversight.
The technical root cause stems from an insufficient authorization check within the plugin's codebase. The existing logic verifies whether a user possesses edit_posts or edit_post permissions on a parent post they own. While these checks are necessary for basic functionality, they fail to account for the sensitivity of private posts authored by other users. A contributor can easily satisfy the condition of owning at least one public post and possessing the requisite editing rights for that specific item. Consequently, the system incorrectly grants access to retrieve metadata such as titles and publication dates from all private posts across the entire site, regardless of who originally published them or what privacy settings were applied by those authors. This represents a classic case where functional permissions are conflated with data visibility rules, leading to an unauthorized information disclosure scenario.
From an operational perspective, this vulnerability enables significant sensitive information exposure that can compromise both user privacy and organizational security posture. Attackers can enumerate private content without needing elevated privileges or exploiting complex injection techniques, simply by leveraging their existing contributor status. The extracted metadata provides valuable intelligence about unpublished work, internal communications, or draft strategies that were intended to remain hidden from lower-level staff members. This exposure aligns with CWE-200, which categorizes the improper restriction of information access for unauthorized individuals, and maps directly to ATT&CK technique T1005, indicating data collection from local system sources through legitimate means rather than exploitation of code execution flaws. The ease of exploitation lowers the barrier for malicious insiders or compromised accounts with minimal privileges to gather actionable intelligence about an organization's internal operations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements in access control logic. Administrators should immediately update the Related Posts plugin to a version where this vulnerability has been patched, ensuring that developers have implemented stricter checks on post visibility status before returning data. In cases where updating is not immediately feasible, temporary workarounds might include restricting contributor-level users from accessing specific endpoints if possible through server-side configurations or additional security plugins that enforce granular permission controls. Furthermore, a thorough review of all custom code and third-party integrations for similar authorization flaws is recommended to prevent recurrence. Implementing principle of least privilege more rigorously across the platform will ensure that editing rights do not inadvertently translate into viewing rights for restricted content types. Regular audits of user roles and capabilities against actual data access requirements are essential to maintaining a secure environment where sensitive information remains protected from unauthorized eyes.