YMC Filter CVE-2026-10823

Exploitation requires only that the vulnerable YMC Filter plugin (version below 3.11.3) be installed and active on an internet-reachable WordPress site with its REST API accessible; per the CVSS vector AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special non-default configuration required - the specific prerequisite is reaching the plugin's unauthorized REST endpoint and supplying the unvalidated query parameter. The practical limiting factor is impact scope: the flaw only exposes the titles and content of non-public posts, so its value to an attacker depends on whether the target site actually keeps sensitive information in private/draft/pending posts; sites with no sensitive unpublished content have little to lose, and sites that block /wp-json/ REST access for anonymous users are not exploitable.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: network-reachable, low-complexity, no privileges, no user interaction, and confidentiality-only impact (no data modification or denial of service), yielding 7.5 (High). A public exploit is reported by WPScan, which raises practical risk because exploitation is trivial and scriptable against any exposed site. No EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV, so there is no evidence of confirmed active exploitation at this time - POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was supplied. The realistic priority is moderate-to-high for sites that store sensitive content in non-public posts, but the impact ceiling is bounded to disclosure of post titles and content only - there is no code execution, no write access, and no availability impact.

An attacker enumerates a WordPress site, identifies the YMC Filter plugin, and sends a crafted unauthenticated request to its REST API endpoint with a manipulated query parameter. Because a public exploit exists and no authentication or user interaction is required, the attacker scripts the request to retrieve the titles and bodies of private and draft posts - for example harvesting embargoed announcements, unpublished articles, or internal content - across many sites at scale.