Contextual Related Posts EUVD-2026-12812

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a practical, remotely exploitable vulnerability with low attack complexity and no privilege requirements, scoring a moderate 5.3. While the CVSS score is not severe, the combination of network accessibility, zero required privileges, and lack of user interaction elevates the real-world risk significantly; any unauthenticated visitor to a WordPress site running the plugin can potentially trigger the information disclosure. The vulnerability was reported by Patchstack (a reputable WordPress security researcher) and tracked via ENISA's EUVD-2026-12812, suggesting it has undergone independent verification. The absence of active exploitation data in KEV and unclear POC availability prevent classification as actively exploited, but the low barrier to exploitation (no authentication, no interaction) means weaponization is trivial. SSVC considerations favor patching: exploitation is probable given the simple attack surface, the technical impact is moderate (information disclosure of plugin/site data), and this affects a plugin with potentially wide WordPress ecosystem reach.

An unauthenticated attacker sends HTTP requests to the WordPress site hosting the vulnerable Contextual Related Posts plugin, targeting administrative or data-exposure endpoints that should require authentication but do not due to the missing authorization check. The attacker retrieves sensitive plugin configuration data, related post metadata, or internal site structure information without logging in or interacting with any UI elements, gaining reconnaissance information useful for further site compromise. Because the vulnerability requires only network access and has zero complexity, exploitation can occur immediately upon plugin installation and can be automated across multiple WordPress sites using standard vulnerability scanning tools.