Related Posts for WordPress EUVD-2026-111754

Requires an authenticated WordPress account with Contributor-level capabilities (or higher) on a site running Related Posts for WordPress 3.0.0 or earlier; the attacker must own at least one parent post so the plugin's edit_posts/edit_post check on that post passes, then reach the admin Related Posts link screen and supply the 'rp4wp_view' parameter. Limiting factors: exploitation is gated by valid low-privilege authentication (PR:L - most relevant on multi-author sites where untrusted Contributors exist), and the disclosure is limited to private-post titles and publication dates, not post bodies, private data content, or credentials. On single-author or tightly controlled sites with no low-trust Contributor accounts, realistic exposure is minimal.

This is a low-to-moderate severity authorization flaw (CWE-862, Missing Authorization) whose real-world priority is modest. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) tells a consistent story: network-reachable and low-complexity, but requiring an authenticated Contributor-level account (PR:L), with only a limited confidentiality impact (C:L) and no integrity or availability impact. The impact is narrow - exposure of titles and publication dates of other authors' private posts, not full post content, credentials, or site compromise. No EPSS score, KEV listing, or SSVC automatable/technical-impact data is provided in the input, so exploitation probability cannot be quantified from the signals given; the only priority signal is the vuln.today 'this_month' label, which aligns with a non-emergency but patch-worthy issue. There is no public exploit identified in the input - the references are a Wordfence advisory and plugin source/changeset links, not working exploit code. The CVSS vector and the description agree (both point to a logged-in low-privilege attacker), so there is no network-vs-local or auth conflict to reconcile. Net assessment: a genuine broken-access-control bug worth patching on a normal cycle, not a high-urgency emergency, given the authentication requirement and the limited metadata-only disclosure.

A user with only Contributor-level access to a multi-author WordPress site logs in and visits the plugin's Related Posts link screen, supplying the 'rp4wp_view' parameter against a parent post they own. Because the page only checks edit_posts and edit_post on that attacker-owned parent - capabilities any Contributor holds - the attacker is able to enumerate the titles and publication dates of every private post site-wide, information normally restricted to Editors and above. No public exploit code is identified in the input, and exploitation requires a valid low-privilege account on the target site.