{"id":"CVE-2026-109980","kind":"vulnerability","aliases":["CVE-2026-109980"],"related":[],"title":"WordPress Related Posts plugin: contributors can read private post titles","description":"The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies edit_posts and edit_post on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.","summary":"The Related Posts for WordPress plugin up to and including 3.0.0 has a flawed authorization check on the rp4wp_view parameter. An authenticated Contributor can list the titles and publication dates of all private posts on the site, which normally only Editors and above can see.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-users","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get related-posts-for-wp --field=version` if WP-CLI is available.\n- Confirm whether any user holds the Contributor role on the site.","fix":"- Update the Related Posts for WordPress plugin to a version later than `3.0.0`.\n- Until updated, remove untrusted Contributor accounts or deactivate the plugin.","status":"open","published_at":"2026-10-28T07:16:45+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:33:29+00:00","updated_at":"2026-10-28T07:33:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Related Posts for WordPress plugin to a version later than `3.0.0`.\n- Until updated, remove untrusted Contributor accounts or deactivate the plugin.","reach":"internet","title":"WordPress Related Posts plugin: contributors can read private post titles","impact":"medium","summary":"The Related Posts for WordPress plugin up to and including 3.0.0 has a flawed authorization check on the rp4wp_view parameter. An authenticated Contributor can list the titles and publication dates of all private posts on the site, which normally only Editors and above can see.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Contributor reads titles and dates of other authors' private posts","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get related-posts-for-wp --field=version` if WP-CLI is available.\n- Confirm whether any user holds the Contributor role on the site.","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-users","plugin-updated"],"who_is_affected":"Sites running the Related Posts for WordPress plugin at version 3.0.0 or earlier that also have Contributor-level accounts, including accounts that are not fully trusted. Sites without this plugin, or without any contributor-level users, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3420,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109980':13A,16A '-2026':12A,15A '3.0.0':35B,92C 'access':109C 'attack':104C,153C 'authent':47B,103C 'author':39B,139C,168C 'check':40B,140C 'contributor':5A,48B,107C,159C 'contributor-level':106C 'cve':11A,14A 'date':55B,118C 'edit':143C,146C 'editor':66B,130C 'editor-level':129C 'effect':163C 'exist':138C 'exposur':84C 'extract':113C 'flaw':38B 'gate':164C 'host':20B 'includ':34B,91C 'inform':83C 'leav':161C 'level':108C,131C 'list':50B 'make':99C 'normal':64B,126C 'own':154C 'packag':17B 'page':136C 'paramet':45B,97C 'parent':150C 'plugin':4A,24B,30B,76C 'possibl':101C 'post':3A,9A,27B,59B,73C,122C,144C,147C,151C,170C 'privat':8A,58B,121C,169C 'public':54B,117C 'read':7A,166C 'relat':2A,26B,72C 'restrict':127C 'rp4wp':43B,95C 'satisfi':160C 'see':70B 'self':19B 'self-host':18B 'sensit':82C 'site':62B,124C 'site-wid':123C 'titl':10A,52B,115C 'user':132C 'verifi':142C 'version':87C 'via':93C 'view':44B,96C 'vulner':80C 'wide':125C 'wordpress':1A,21B,23B,29B,75C,78C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Related Posts for WordPress plugin at version 3.0.0 or earlier that also have Contributor-level accounts, including accounts that are not fully trusted. Sites without this plugin, or without any contributor-level users, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109980","severity":null,"published_at":"2026-10-28T07:16:45+00:00","modified_at":"2026-10-28T07:16:45+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}