Related Posts For Wordpress
Monthly
Missing authorization in the Related Posts for WordPress plugin (barrykooij) through version 3.0.0 lets any authenticated Contributor-level user enumerate the titles and publication dates of every private post site-wide by supplying the 'rp4wp_view' parameter to the plugin's admin link screen. The only gate on that screen verifies edit_posts and edit_post against a parent post the attacker already owns - capabilities every Contributor holds - so nothing prevents the private-post query from returning other authors' data. Disclosure is confined to titles and publication dates rather than post bodies or credentials, exploitation requires a valid low-privilege account, and no public exploit code has been identified at time of analysis; the current priority is this_month rather than emergency action.
Related Posts for WordPress through version 3.0.0 allows authenticated users holding Contributor-level access or higher to read the titles of non-public posts they are not authorized to see, including drafts, pending, private, future and trashed posts owned by higher-privileged users. The hidden 'rp4wp_link_related' admin page checks the nonce and the ability to edit the parent post but never verifies that the caller may read the attacker-supplied child post ID, so linking an arbitrary post ID to a draft the attacker owns causes that post's title to be echoed back in the editor meta box. Rated CVSS 4.3 (medium, PR:L, C:L only) with no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to title disclosure for authenticated Contributors and above, so real-world risk is modest rather than urgent.
Missing authorization in the Related Posts for WordPress plugin (barrykooij) through version 3.0.0 lets any authenticated Contributor-level user enumerate the titles and publication dates of every private post site-wide by supplying the 'rp4wp_view' parameter to the plugin's admin link screen. The only gate on that screen verifies edit_posts and edit_post against a parent post the attacker already owns - capabilities every Contributor holds - so nothing prevents the private-post query from returning other authors' data. Disclosure is confined to titles and publication dates rather than post bodies or credentials, exploitation requires a valid low-privilege account, and no public exploit code has been identified at time of analysis; the current priority is this_month rather than emergency action.
Related Posts for WordPress through version 3.0.0 allows authenticated users holding Contributor-level access or higher to read the titles of non-public posts they are not authorized to see, including drafts, pending, private, future and trashed posts owned by higher-privileged users. The hidden 'rp4wp_link_related' admin page checks the nonce and the ability to edit the parent post but never verifies that the caller may read the attacker-supplied child post ID, so linking an arbitrary post ID to a draft the attacker owns causes that post's title to be echoed back in the editor meta box. Rated CVSS 4.3 (medium, PR:L, C:L only) with no CISA KEV listing and no public exploit identified at time of analysis; impact is confined to title disclosure for authenticated Contributors and above, so real-world risk is modest rather than urgent.