CVE-2026-121724 · Package
NO FIX YET · SEE WHAT TO DO
The Contextual Related Posts WordPress plugin, from its earliest release through version 4.5.3, has a missing authorization check. The sources say an attacker can exploit incorrectly configured access control to reach functions they should not.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Contextual Related Posts WordPress plugin version 4.5.3 or earlier are in scope. The sources do not say which configuration or role makes the access control flaw reachable, so whether a given site is exposed is unknown.
Not affected if plugin-not-installed
Who cares contextual-related-posts, self-hosted, wordpress
contextual-related-posts plugin directory and its main file header.contextual-related-posts plugin to a version later than 4.5.3, if the sources name one; the sources do not state a fixed version.Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.