Sensitive Data Exposure in WP Private Content Plus Plugin for WordPress

CVE-2025-4390

What is CVE-2025-4390?

The WP Private Content Plus plugin for WordPress is susceptible to sensitive information exposure due to a flaw in the 'validate_restrictions' function. This vulnerability allows unauthenticated attackers to access and extract sensitive data, including restricted post content, via archive and feed pages. Users of all versions up to and including 3.6.2 should be particularly cautious, as this security weakness can lead to significant data leaks.

References