CVE-2026-109980: Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter

Q: Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to access the affected plugin functionality and use the rp4wp_view parameter.

Q: What information can be exposed?

An attacker can extract the titles and publication dates of private posts across the site, including posts owned by other authors. The issue does not state that private post content is exposed.

Q: Are sites using the plugin affected by default?

Affected versions through 3.0.0 do not effectively restrict this view to users authorized to read other authors' private posts. The existing checks allow a Contributor who can edit a parent post they own to pass the authorization check.

Q: How can I determine whether my site is affected?

Check whether Related Posts for WordPress is installed at version 3.0.0 or earlier. Also review whether Contributor or higher roles are assigned to users who should not be able to learn titles and publication dates of private posts.

Published Oct 28, 2026

Updated

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wpview' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and publication dates of all private posts site-wide, normally restricted to Editor-level users and above. The page's existing authorization check only verifies editposts and editpost on a parent post the attacker owns, both of which any Contributor satisfies, leaving no effective gate against reading other authors' private posts.

Affected Software

1 affected component

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker must be able to access the affected plugin functionality and use the rp4wp_view parameter.

What information can be exposed?

An attacker can extract the titles and publication dates of private posts across the site, including posts owned by other authors. The issue does not state that private post content is exposed.

Are sites using the plugin affected by default?

Affected versions through 3.0.0 do not effectively restrict this view to users authorized to read other authors' private posts. The existing checks allow a Contributor who can edit a parent post they own to pass the authorization check.

How can I determine whether my site is affected?

Check whether Related Posts for WordPress is installed at version 3.0.0 or earlier. Also review whether Contributor or higher roles are assigned to users who should not be able to learn titles and publication dates of private posts.

CVE-2026-109980: Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are sites using the plugin affected by default?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are sites using the plugin affected by default?

How can I determine whether my site is affected?