{
 "id": "WPSEC-2026-1169",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1169/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1169/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1169/index.md",
 "title": "Contextual Related Posts <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Related Post Thumbnails of Password-Protected Posts",
 "description": "The Contextual Related Posts plugin for WordPress is vulnerable to Sensitive Information Exposure via related post thumbnails in all versions up to, and including, 4.5.1, due to the thumbnail logic not checking whether a related post is password-protected before scanning its content and its first attached image for a thumbnail. This makes it possible for unauthenticated attackers to view images embedded in or attached to password-protected posts without knowing the post password, because those images are shown as thumbnails in the related-posts output.",
 "plugin": {
  "slug": "contextual-related-posts",
  "name": "Contextual Related Posts",
  "full_name": "Contextual Related Posts",
  "wordpress_org": "https://wordpress.org/plugins/contextual-related-posts/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contextual-related-posts/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contextual-related-posts"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.5.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.5.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.5.2",
 "remediation": "Update to 4.5.2 or later.",
 "fix_released": "2026-10-16T09:00:48+00:00",
 "published": "2026-10-17T09:45:54+00:00",
 "updated": "2026-10-17T08:19:21.749122+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1169/",
  "https://plugins.svn.wordpress.org/contextual-related-posts/tags/4.5.2/",
  "https://wordpress.org/plugins/contextual-related-posts/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contextual-related-posts",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-17"
 }
}