{
 "id": "WPSEC-2026-1131",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1131/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1131/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1131/index.md",
 "title": "WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Popular Posts REST Endpoint",
 "description": "The WebberZone Top 10 plugin for WordPress is vulnerable to Sensitive Information Exposure via the public popular-posts REST endpoint (top-10/v1/popular-posts) in all versions up to, and including, 4.5.3, due to the endpoint passing every request parameter directly into the popular posts query instead of only its documented parameters. This makes it possible for unauthenticated attackers to supply arbitrary query variables such as meta_key/meta_value or meta_query, and use whether a post appears in the results to work out the values of hidden or private post meta. They can also request unbounded result sets that cause expensive database queries.",
 "plugin": {
  "slug": "top-10",
  "name": "WebberZone Top 10",
  "full_name": "WebberZone Top 10 — Popular Posts",
  "wordpress_org": "https://wordpress.org/plugins/top-10/",
  "advisories_url": "https://wpsec.com/vuln/plugin/top-10/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/top-10"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.6.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.6.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.6.0",
 "remediation": "Update to 4.6.0 or later.",
 "fix_released": "2026-10-15T18:07:19+00:00",
 "published": "2026-10-16T18:43:17+00:00",
 "updated": "2026-10-16T09:50:01.345723+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1131/",
  "https://plugins.svn.wordpress.org/top-10/tags/4.6.0/",
  "https://wordpress.org/plugins/top-10/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/top-10",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}