# WebberZone Top 10 <= 4.5.3 - Unauthenticated Sensitive Information Exposure via Popular Posts REST Endpoint

- **ID:** WPSEC-2026-1131
- **Plugin:** WebberZone Top 10 — Popular Posts (`top-10`), https://wordpress.org/plugins/top-10/
- **Affected versions:** all versions before 4.6.0
- **Fixed in:** 4.6.0 (Update to 4.6.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/top-10
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1131/

## Description

The WebberZone Top 10 plugin for WordPress is vulnerable to Sensitive Information Exposure via the public popular-posts REST endpoint (top-10/v1/popular-posts) in all versions up to, and including, 4.5.3, due to the endpoint passing every request parameter directly into the popular posts query instead of only its documented parameters. This makes it possible for unauthenticated attackers to supply arbitrary query variables such as meta_key/meta_value or meta_query, and use whether a post appears in the results to work out the values of hidden or private post meta. They can also request unbounded result sets that cause expensive database queries.

## References

- https://wpsec.com/vuln/WPSEC-2026-1131/
- https://plugins.svn.wordpress.org/top-10/tags/4.6.0/
- https://wordpress.org/plugins/top-10/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1131/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.