Related Posts for WordPress CVE-2026-109979

Requires an authenticated account at Contributor level or above on the target WordPress site (PR:L), since the attacker must be able to create/edit a post of their own to act as the 'parent' and must pass the nonce and edit-parent capability check in handle_create_link(). The attacker then supplies arbitrary child post IDs via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page; LinkRepository::insert() stores them unvalidated and ManageLinks::render() renders their titles through the get_children() no-extra-args fast path. Limiting factors: exploitation is impossible for fully unauthenticated visitors; impact is confined to disclosure of post titles only (not post content, not other fields); and it only affects non-public posts (drafts, pending, private, future, trashed) whose IDs the attacker can reach. These constraints keep real-world risk modest despite the network attack vector.

This is a genuine but low-to-moderate priority issue, not a high-CVSS false alarm - in fact the CVSS base score is only 4.3 (medium), which is consistent with the limited impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N) tells a coherent story that matches the description: network-reachable admin page, low attack complexity, but requires authenticated low-privilege access (PR:L = Contributor-level or above) and yields only limited confidentiality impact (C:L) - the ability to read the titles (not bodies) of non-public posts, with no integrity or availability effect. EPSS is not supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no confirmed working exploit, so there is no evidence of active exploitation. An SSVC decision framework was not provided; the only decision signal is the vuln.today priority label 'this_month', which aligns with a real-but-not-urgent issue - it is neither act_now nor emergency. The signals are mutually consistent (authenticated, low-impact, information-disclosure-only), so there is no conflict to flag; the main missing data points are EPSS and any SSVC automatable/technical-impact scoring.

A user with a Contributor-level (or higher) account creates a draft post they own, then submits crafted 'rp4wp_create_link' requests to the hidden 'rp4wp_link_related' admin page supplying post IDs belonging to higher-privileged users (admin drafts, pending, private, future, or trashed posts). Because the handler never validates that the attacker may read the linked child post, the parent post's editor meta box then renders esc_html($child->post_title), leaking those non-public titles back to the attacker. No public exploit was identified at time of analysis; the references are plugin source lines and a Wordfence advisory rather than exploit code.