# Contextual Related Posts <= 4.5.1 - Unauthenticated Sensitive Information Exposure via Related Post Thumbnails of Password-Protected Posts

- **ID:** WPSEC-2026-1169
- **Plugin:** Contextual Related Posts (`contextual-related-posts`), https://wordpress.org/plugins/contextual-related-posts/
- **Affected versions:** all versions before 4.5.2
- **Fixed in:** 4.5.2 (Update to 4.5.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contextual-related-posts
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1169/

## Description

The Contextual Related Posts plugin for WordPress is vulnerable to Sensitive Information Exposure via related post thumbnails in all versions up to, and including, 4.5.1, due to the thumbnail logic not checking whether a related post is password-protected before scanning its content and its first attached image for a thumbnail. This makes it possible for unauthenticated attackers to view images embedded in or attached to password-protected posts without knowing the post password, because those images are shown as thumbnails in the related-posts output.

## References

- https://wpsec.com/vuln/WPSEC-2026-1169/
- https://plugins.svn.wordpress.org/contextual-related-posts/tags/4.5.2/
- https://wordpress.org/plugins/contextual-related-posts/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1169/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.