Contextual Related Posts <= 4.5.3 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode and Block Attributes
- ID
- WPSEC-2026-2514
- Plugin
- Contextual Related Posts (contextual-related-posts)
- Affected
- from 3.0.0 before 4.5.4
- Remediation
- Update to 4.5.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Contextual Related Posts on WPSec AttackSurface
- Fix released
- Published
Description
The Contextual Related Posts plugin for WordPress is vulnerable to Sensitive Information Exposure via the related posts block and shortcode attributes in all versions up to, and including, 4.5.3, due to insufficient restriction of user-supplied query arguments such as post_status, post_type, post_id, thumb_meta and acf_field, including those passed through the block's free-form other_attributes string. This makes it possible for authenticated attackers, with contributor-level access and above, to list the titles and excerpts of draft, private and other non-public content, use non-public posts as the related posts source, and potentially expose values of protected post meta keys.
References
- https://wpsec.com/vuln/WPSEC-2026-2514/
- https://plugins.svn.wordpress.org/contextual-related-posts/tags/4.5.4/
- https://wordpress.org/plugins/contextual-related-posts/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS