EUVD-2026-71852
GHSA-65wg-cc3c-9rfp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible, no auth required, but AC:H because only specific front-end surfaces are unprotected; impact is read-only low-confidentiality content disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.
AnalysisAI
Unauthenticated information disclosure in the My Private Site WordPress plugin (all versions before 4.2.3) exposes post content, post URLs, and comments to anonymous visitors, directly defeating the plugin's stated purpose of enforcing mandatory login across a WordPress site. The plugin fails to apply its privacy gate to certain front-end read surfaces, meaning requests to those endpoints bypass the authentication requirement entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable condition requires that the target WordPress site has the My Private Site plugin installed and active in a version below 4.2.3, and that the site administrator has configured the plugin to enforce mandatory login for all visitors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw CVSS score of 3.7 with AC:H accurately reflects a limited-scope, low-severity disclosure: exploitation requires targeting specific front-end surfaces (raising complexity), impact is bounded to confidentiality at a low level, and no integrity or availability harm exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the My Private Site WordPress plugin to version 4.2.3 or later via the WordPress admin dashboard or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in My Private Site
View allThe My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which co
The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today