What is the CVSS score of EUVD-2026-39624?

EUVD-2026-39624 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of YMC Filter are affected by EUVD-2026-39624?

The YMC Filter WordPress plugin (versions before 3.11.3) allows unauthenticated attackers to read private and draft posts, enabling disclosure of sensitive business content and protected…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-39624?

Yes, a public proof-of-concept exploit is available for EUVD-2026-39624. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-39624?

Within 24 hours: Identify all WordPress installations using the YMC Filter plugin and document current versions. Within 7 days: Update the YMC Filter plugin to version 3.11.3 or later on all affected instances. Within 30 days: Review access logs for suspicious REST API queries, audit which non-public content may have been accessed, and confirm successful updates across the environment.

YMC Filter EUVD-2026-39624

| CVE-2026-10823 HIGH

2026-06-26 WPScan

GHSA-cxq8-qm2q-phgj

WordPress Information Disclosure Ymc Filter Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network REST request (AV:N/AC:L/PR:N/UI:N) discloses non-public post content (C:H) with no integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 13:22 vuln.today

CVSS changed

Jun 26, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jun 26, 2026 - 08:01 EUVD

CVE Published

Jun 26, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 26, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

Articles & Coverage 1

News 11 New WordPress Vulnerabilities - 1 Critical, 10 High, 2 With POC Jun 27, 2026

AnalysisAI

Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the titles and content of private, draft, and other non-public posts by abusing a REST API endpoint that lacks proper authorization and fails to validate a user-supplied query parameter. WPScan reported the flaw, a public exploit exists, and a vendor patch is available; the CVSS 3.1 score is 7.5 reflecting high confidentiality impact with no integrity or availability effect.

Technical ContextAI

The affected component is the YMC Filter plugin for WordPress, which exposes one or more endpoints through the WordPress REST API. The root cause is a broken/missing authorization check (a Broken Access Control / missing function-level authorization class issue - no CWE was assigned in the input) combined with insufficient input validation of a user-supplied query parameter. By supplying that parameter to the unprotected REST route, an attacker can coerce the plugin into returning post objects that WordPress would normally restrict to authenticated, capability-bearing users (e.g. posts with status 'private', 'draft', 'pending', or other non-published states). The single CPE provided, cpe:2.3:a:unknown:ymc_filter:*:*:*:*:*:*:*:*, identifies the product but lists the vendor as 'unknown' and does not bound the version in the CPE itself.

RemediationAI

Vendor-released patch: upgrade the YMC Filter plugin to version 3.11.3 or later, which is the primary and recommended fix; consult the WPScan advisory at https://wpscan.com/vulnerability/b55ebf9e-a05d-4ae4-b653-da7db63e76d2/ for confirmation. If immediate patching is not possible, compensating controls include deactivating the YMC Filter plugin entirely (side effect: any filtering functionality it provides will stop working), or restricting access to the plugin's vulnerable REST API route at the web-server or WAF layer by blocking unauthenticated requests to the plugin's REST namespace under /wp-json/ (side effect: legitimate front-end features that call the endpoint anonymously may break). Avoid storing highly sensitive material in draft/private posts on exposed sites until patched, and review access logs for anomalous REST API queries.