{
 "id": "WPSEC-2026-2514",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2514/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2514/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2514/index.md",
 "title": "Contextual Related Posts <= 4.5.3 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode and Block Attributes",
 "description": "The Contextual Related Posts plugin for WordPress is vulnerable to Sensitive Information Exposure via the related posts block and shortcode attributes in all versions up to, and including, 4.5.3, due to insufficient restriction of user-supplied query arguments such as post_status, post_type, post_id, thumb_meta and acf_field, including those passed through the block's free-form other_attributes string. This makes it possible for authenticated attackers, with contributor-level access and above, to list the titles and excerpts of draft, private and other non-public content, use non-public posts as the related posts source, and potentially expose values of protected post meta keys.",
 "plugin": {
  "slug": "contextual-related-posts",
  "name": "Contextual Related Posts",
  "full_name": "Contextual Related Posts",
  "wordpress_org": "https://wordpress.org/plugins/contextual-related-posts/",
  "advisories_url": "https://wpsec.com/vuln/plugin/contextual-related-posts/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/contextual-related-posts"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "4.5.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 4.5.4"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "4.5.4",
 "remediation": "Update to 4.5.4 or later.",
 "fix_released": "2026-11-03T17:35:22+00:00",
 "published": "2026-11-04T17:48:32+00:00",
 "updated": "2026-11-04T13:57:10.848636+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2514/",
  "https://plugins.svn.wordpress.org/contextual-related-posts/tags/4.5.4/",
  "https://wordpress.org/plugins/contextual-related-posts/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/contextual-related-posts",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}