https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 13:19:58 +0000 https://db.gcve.eu/vuln/cve-2026-109979 <p><strong>Affected:</strong> barrykooij Related Posts for WordPress</p> <p>The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the &#39;rp4wp_create_link&#39; parameter of the hidden &#39;rp4wp_link_related&#39; admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map(&#39;get_post&#39;, $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child-&gt;post_title) in the parent&#39;s editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.</p> <p><strong>Affected:</strong> barrykooij Related Posts for WordPress</p> <p>The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the &#39;rp4wp_create_link&#39; parameter of the hidden &#39;rp4wp_link_related&#39; admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map(&#39;get_post&#39;, $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child-&gt;post_title) in the parent&#39;s editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.</p> https://db.gcve.eu/vuln/cve-2026-109979