Live › vulnerability › CVE-2026-109980
Go to dashboardThe Related Posts for WordPress plugin up to and including 3.0.0 has a flawed authorization check on the rp4wp_view parameter. An authenticated Contributor can list the titles and publication dates of all private posts on the site, which normally only Editors and above can see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the Related Posts for WordPress plugin at version 3.0.0 or earlier that also have Contributor-level accounts, including accounts that are not fully trusted. Sites without this plugin, or without any contributor-level users, are not exposed.
No product ranges from the sources yet.
wp plugin get related-posts-for-wp --field=version if WP-CLI is available.3.0.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.
This page as .md · .json · in your agent: get_signal("CVE-2026-109980")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.