# Contextual Related Posts <= 4.5.3 - Authenticated (Contributor+) Sensitive Information Exposure via Shortcode and Block Attributes

- **ID:** WPSEC-2026-2514
- **Plugin:** Contextual Related Posts (`contextual-related-posts`), https://wordpress.org/plugins/contextual-related-posts/
- **Affected versions:** from 3.0.0 before 4.5.4
- **Fixed in:** 4.5.4 (Update to 4.5.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/contextual-related-posts
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2514/

## Description

The Contextual Related Posts plugin for WordPress is vulnerable to Sensitive Information Exposure via the related posts block and shortcode attributes in all versions up to, and including, 4.5.3, due to insufficient restriction of user-supplied query arguments such as post_status, post_type, post_id, thumb_meta and acf_field, including those passed through the block's free-form other_attributes string. This makes it possible for authenticated attackers, with contributor-level access and above, to list the titles and excerpts of draft, private and other non-public content, use non-public posts as the related posts source, and potentially expose values of protected post meta keys.

## References

- https://wpsec.com/vuln/WPSEC-2026-2514/
- https://plugins.svn.wordpress.org/contextual-related-posts/tags/4.5.4/
- https://wordpress.org/plugins/contextual-related-posts/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2514/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.