CVE-2026-109979: Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter

Q: Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The user must be able to edit a parent post they control, such as a draft.

Q: What information can an attacker obtain?

An attacker can disclose the titles of arbitrary non-public posts, including drafts, pending, private, scheduled, and trashed posts authored by higher-privileged users. The provided data describes title exposure, not disclosure of post content.

Q: What does an attacker need to do to exploit it?

The attacker supplies an arbitrary child post ID through the rp4wp_create_link parameter, links it to a draft they can edit, and views the resulting related-posts meta box. The nonce and permission to edit the attacker-controlled parent post are required, but the plugin does not validate permission to read the selected child post.

Q: How can I tell whether an installation is affected?

Installations running Related Posts for WordPress version 3.0.0 or earlier are affected according to the provided data. A practical indicator is whether a Contributor can link a non-public post ID to their own draft and subsequently see that post's title in the editor meta box.

Published Oct 28, 2026

Updated

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::getchildren() in its no-extra-args fast path, which falls through to arraymap('getpost', $childids) — bypassing readprivateposts/readpost capability checks — and then echoes eschtml($child->posttitle) in the parent's editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.

Affected Software

1 affected component

WordPress Related Posts for WordPress<=3.0.0

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The user must be able to edit a parent post they control, such as a draft.

What information can an attacker obtain?

An attacker can disclose the titles of arbitrary non-public posts, including drafts, pending, private, scheduled, and trashed posts authored by higher-privileged users. The provided data describes title exposure, not disclosure of post content.

What does an attacker need to do to exploit it?

The attacker supplies an arbitrary child post ID through the rp4wp_create_link parameter, links it to a draft they can edit, and views the resulting related-posts meta box. The nonce and permission to edit the attacker-controlled parent post are required, but the plugin does not validate permission to read the selected child post.

How can I tell whether an installation is affected?

Installations running Related Posts for WordPress version 3.0.0 or earlier are affected according to the provided data. A practical indicator is whether a Contributor can link a non-public post ID to their own draft and subsequently see that post's title in the editor meta box.

CVE-2026-109979: Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

What does an attacker need to do to exploit it?

How can I tell whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can an attacker obtain?

What does an attacker need to do to exploit it?

How can I tell whether an installation is affected?