Wp Popular Posts
Monthly
Unauthenticated information disclosure in WP Popular Posts (all versions up to and including 7.4.2) lets any remote attacker read sensitive edit-context fields - raw title, raw content body, password, meta, status, and guid - from non-public post objects such as drafts, private or password-protected posts, and wp_block synced patterns that WordPress core itself refuses to expose to anonymous callers. Scoring CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium), the flaw requires no authentication, user interaction, or non-default configuration because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (for example context=edit) directly into WP_REST_Posts_Controller::prepare_item_for_response() while the underlying query accepts an arbitrary post_type without enforcing public or show_in_rest visibility. The practical limit is data-dependent rather than access-dependent - a site with no sensitive non-public content leaks little - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated information disclosure in WP Popular Posts (all versions up to and including 7.4.2) lets any remote attacker read sensitive edit-context fields - raw title, raw content body, password, meta, status, and guid - from non-public post objects such as drafts, private or password-protected posts, and wp_block synced patterns that WordPress core itself refuses to expose to anonymous callers. Scoring CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium), the flaw requires no authentication, user interaction, or non-default configuration because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (for example context=edit) directly into WP_REST_Posts_Controller::prepare_item_for_response() while the underlying query accepts an arbitrary post_type without enforcing public or show_in_rest visibility. The practical limit is data-dependent rather than access-dependent - a site with no sensitive non-public content leaks little - and no public exploit code or confirmed active exploitation was identified at time of analysis.