CVE-2026-109980

Name of the Vulnerable Software and Affected Versions Related Posts for WordPress versions prior to 3.0.1

Description Authenticated attackers with contributor-level access and above can extract titles and publication dates of all private posts across the site. This occurs because the authorization check only verifies edit posts and edit post permissions on a parent post owned by the attacker, which does not prevent the reading of private posts belonging to other authors. The issue is triggered via the rp4wp view parameter.

Recommendations Update Related Posts for WordPress to a version newer than 3.0.0. Avoid using the rp4wp view parameter until the plugin is updated.