WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Popular Posts REST Endpoint
- ID
- WPSEC-2026-1131
- Plugin
- WebberZone Top 10 — Popular Posts (top-10)
- Affected
- all versions before 4.6.0
- Remediation
- Update to 4.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- WebberZone Top 10 on WPSec AttackSurface
- Fix released
- Published
Description
The WebberZone Top 10 plugin for WordPress is vulnerable to Sensitive Information Exposure via the public popular-posts REST endpoint (top-10/v1/popular-posts) in all versions up to, and including, 4.5.3, due to the endpoint passing every request parameter directly into the popular posts query instead of only its documented parameters. This makes it possible for unauthenticated attackers to supply arbitrary query variables such as meta_key/meta_value or meta_query, and use whether a post appears in the results to work out the values of hidden or private post meta. They can also request unbounded result sets that cause expensive database queries.
References
- https://wpsec.com/vuln/WPSEC-2026-1131/
- https://plugins.svn.wordpress.org/top-10/tags/4.6.0/
- https://wordpress.org/plugins/top-10/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS