CVE-2026-92548: WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wpblock synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permissioncallback of returntrue and passes the caller-supplied context parameter (e.g., context=edit) directly to WPRESTPostsController::prepareitemforresponse() without invoking getitempermissionscheck() or checkreadpermission(), while the underlying query accepts an arbitrary posttype value without enforcing public or showinrest visibility flags.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No WordPress account, user interaction, or special privileges are required.
What data may be exposed?
An attacker may retrieve sensitive edit-context fields from non-public post objects, including raw titles, raw content bodies, passwords, metadata, status, and GUIDs. Synced patterns using the wp_block post type are specifically identified as affected non-public objects.
What conditions make a site vulnerable?
Sites using WP Popular Posts version 7.4.2 or earlier are affected. The vulnerable REST route accepts caller-controlled context and arbitrary post_type values without enforcing normal WordPress read-permission or post visibility checks.
Does this require a non-default configuration or a public post type?
No. The issue is specifically caused by the route allowing arbitrary post types, including non-public objects that WordPress core would normally refuse to expose to unauthenticated users.