{"id":"CVE-2026-121724","kind":"vulnerability","aliases":["CVE-2026-121724"],"related":[],"title":"WordPress Contextual Related Posts plugin: missing authorization check through 4.5.3","description":"Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3.","summary":"The Contextual Related Posts WordPress plugin, from its earliest release through version 4.5.3, has a missing authorization check. The sources say an attacker can exploit incorrectly configured access control to reach functions they should not.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contextual-related-posts","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `contextual-related-posts` plugin directory and its main file header.","fix":"- Move the `contextual-related-posts` plugin to a version later than `4.5.3`, if the sources name one; the sources do not state a fixed version.","status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:39+00:00","updated_at":"2026-11-07T11:48:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move the `contextual-related-posts` plugin to a version later than `4.5.3`, if the sources name one; the sources do not state a fixed version.","reach":"unknown","title":"WordPress Contextual Related Posts plugin: missing authorization check through 4.5.3","impact":"medium","summary":"The Contextual Related Posts WordPress plugin, from its earliest release through version 4.5.3, has a missing authorization check. The sources say an attacker can exploit incorrectly configured access control to reach functions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","contextual-related-posts","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized actions on the WordPress site through the plugin","analyst_note":"Check the NVD entry and the WebberZone plugin changelog for the fixed version and the exact affected function and required privilege.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the `contextual-related-posts` plugin directory and its main file header.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Contextual Related Posts WordPress plugin version 4.5.3 or earlier are in scope. The sources do not say which configuration or role makes the access control flaw reachable, so whether a given site is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4214,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121724':13A,16A '-2026':12A,15A '4.5.3':10A,38B,86C 'access':53B,74C 'affect':79C 'allow':70C 'attack':48B 'author':7A,42B,59C 'check':8A,43B 'configur':52B,73C 'contextu':2A,18B,27B,63C,67C,80C 'contextual-related-post':17B,66C 'control':54B,75C 'cve':11A,14A 'earliest':34B 'exploit':50B,71C 'function':57B 'host':24B 'incorrect':51B,72C 'issu':78C 'levels.this':77C 'miss':6A,41B,58C 'n/a':84C 'packag':21B 'plugin':5A,31B 'post':4A,20B,29B,65C,69C,82C 'reach':56B 'relat':3A,19B,28B,64C,68C,81C 'releas':35B 'say':46B 'secur':76C 'self':23B 'self-host':22B 'sourc':45B 'version':37B 'vulner':60C 'webberzon':62C 'wordpress':1A,25B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Contextual Related Posts WordPress plugin version 4.5.3 or earlier are in scope. The sources do not say which configuration or role makes the access control flaw reachable, so whether a given site is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["contextualrelatedposts","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121724':13A,16A '-2026':12A,15A '4.5.3':10A 'author':7A 'check':8A 'contextu':2A 'cve':11A,14A 'miss':6A 'plugin':5A 'post':4A 'relat':3A 'wordpress':1A","search_b":"'4.5.3':38B 'access':53B 'attack':48B 'author':42B 'check':43B 'configur':52B 'contextu':18B,27B 'contextual-related-post':17B 'control':54B 'earliest':34B 'exploit':50B 'function':57B 'host':24B 'incorrect':51B 'miss':41B 'packag':21B 'plugin':31B 'post':20B,29B 'reach':56B 'relat':19B,28B 'releas':35B 'say':46B 'self':23B 'self-host':22B 'sourc':45B 'version':37B 'wordpress':25B,30B","search_c":"'4.5.3':86C 'access':74C 'affect':79C 'allow':70C 'author':59C 'configur':73C 'contextu':63C,67C,80C 'contextual-related-post':66C 'control':75C 'exploit':71C 'incorrect':72C 'issu':78C 'levels.this':77C 'miss':58C 'n/a':84C 'post':65C,69C,82C 'relat':64C,68C,81C 'secur':76C 'vulner':60C 'webberzon':62C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121724","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}