CVE-2026-10823 PoC — YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-10823.yaml

Associated Vulnerability

Title: YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure (CVE-2026-10823)
Description:The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

Description

YMC Filter WordPress plugin < 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →