Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-10823— YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure

Quick assessment

Affected
Unknown YMC Filter
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

YMC YMC Filter是YMC个人开发者的一款功能强大且灵活的免费 WordPress 高级内容筛选与网格展示插件。 YMC Filter 3.11.3之前版本存在信息泄露漏洞，该漏洞源于未正确授权访问其一个REST API端点且未验证用户提供的查询参数，可能导致未经身份验证的攻击者检索私密、草稿及其他非公开文章的标题和内容。

AI Predicted 7.5 Difficulty: Easy EPSS 1.52% · P74

Public Exploits 1

Nuclei · 1 CVE-2026-10823.yaml [template]

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown YMC Filter < 3.11.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-10823

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
YMC Filter 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
YMC YMC Filter是YMC个人开发者的一款功能强大且灵活的免费 WordPress 高级内容筛选与网格展示插件。 YMC Filter 3.11.3之前版本存在信息泄露漏洞，该漏洞源于未正确授权访问其一个REST API端点且未验证用户提供的查询参数，可能导致未经身份验证的攻击者检索私密、草稿及其他非公开文章的标题和内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown YMC Filter 0 ~ 3.11.3 -

II. Public POCs for CVE-2026-10823

# POC Description Source Link Shenlong Link
1 YMC Filter WordPress plugin < 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10823.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-10823

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-10823 (1)

Same Patch Batch · Unknown · 2026-06-26 · 4 CVEs total

CVE-2025-10268 Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder
CVE-2026-10835 SALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL Injection
CVE-2026-8380 Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion

IV. Related Vulnerabilities

Same product: YMC Filter
Same vendor: Unknown

V. Comments for CVE-2026-10823

No comments yet

Leave a comment