Sensitive Information Exposure in Related Posts Plugin for WordPress

CVE-2026-109979

What is CVE-2026-109979?

The Related Posts for WordPress plugin is susceptible to a Sensitive Information Exposure, allowing authenticated attackers with Contributor-level access or higher to access titles of non-public posts. This vulnerability exists because the plugin fails to validate user permissions for child post IDs when linking related posts. As a result, users may inadvertently disclose drafts, private, or trashed posts authored by higher-privileged users. The compromised functionality arises from inadequacies in nonce verification and permission checks during the handling of post links, leading to potential data breaches.

References