CVE-2026-109979— Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter

Quick assessment

Affected

barrykooij Related Posts for WordPress

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Related Posts for WordPress"在 3.0.0 及更早版本中存在敏感信息泄露漏洞。该漏洞源于隐藏管理页面"rp4wp_link_related"中的"rp4wp_create_link"参数。具体而言，处理器虽然验证了 nonce（一次性令牌）以及当前用户是否有权编辑父文章，但从未检查攻击者提供的子文章 ID 是否为当前用户有权读取的文章。方法在未进行任何验证的情况下，直接存储了任意指定的子文章 ID。随后，方法在其“无额外参数”的快速路径中调用了，该方法

CVSS 4.3 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1040 · Network Sniffing T1078.004 · Cloud Accounts T1551.006

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current user can edit the parent post, but never checks that the attacker-supplied child post ID is one the user is allowed to read; LinkRepository::insert() stores the arbitrary child ID without validation, and ManageLinks::render() later calls LinkRepository::get_children() in its no-extra-args fast path, which falls through to array_map('get_post', $child_ids) — bypassing read_private_posts/read_post capability checks — and then echoes esc_html($child->post_title) in the parent's editor meta box. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the titles of arbitrary non-public posts (drafts, pending, private, future, trashed) authored by higher-privileged users by linking those post IDs to a draft they own and then reading the resulting meta box.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
barrykooij	Related Posts for WordPress	0 ~ 3.0.0	-

II. Public POCs for CVE-2026-109979

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109979

请登录查看更多情报信息。

Other References for CVE-2026-109979 (7)

https://www.cve.org/CVERecord?id=CVE-2026-109979

IV. Related Vulnerabilities

Same product: Related Posts for WordPress

Same vendor: barrykooij

Same weakness: CWE-862