{
 "id": "WPSEC-2026-2179",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2179/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2179/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2179/index.md",
 "title": "Relevanssi <= 4.28.6 - Authenticated (Contributor+) Sensitive Information Exposure via Admin Search",
 "description": "The Relevanssi plugin for WordPress is vulnerable to Sensitive Information Exposure via the admin search in all versions up to, and including, 4.28.6. Draft, pending and scheduled posts were included in admin search results without checking whether the current user can read each post. This makes it possible for authenticated attackers, with Contributor-level access and above, to view draft, pending and future posts written by other users.",
 "plugin": {
  "slug": "relevanssi",
  "name": "Relevanssi",
  "full_name": "Relevanssi – A Better Search",
  "wordpress_org": "https://wordpress.org/plugins/relevanssi/",
  "advisories_url": "https://wpsec.com/vuln/plugin/relevanssi/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/relevanssi"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.28.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.28.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.28.7",
 "remediation": "Update to 4.28.7 or later.",
 "fix_released": "2026-10-30T07:24:41+00:00",
 "published": "2026-10-31T07:44:03+00:00",
 "updated": "2026-10-30T09:32:42.249010+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2179/",
  "https://plugins.svn.wordpress.org/relevanssi/tags/4.28.7/",
  "https://wordpress.org/plugins/relevanssi/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/relevanssi",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-31"
 }
}