CVE-2026-92548
Received Received - Intake

Sensitive Information Exposure in WP Popular Posts Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Wordfence

Description
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wp_block synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter (e.g., context=edit) directly to WP_REST_Posts_Controller::prepare_item_for_response() without invoking get_item_permissions_check() or check_read_permission(), while the underlying query accepts an arbitrary post_type value without enforcing public or show_in_rest visibility flags.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-92548
EUVD
EUVD-2026-90477

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordpress wp_popular_posts to 7.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP Popular Posts plugin for WordPress has a vulnerability that allows unauthenticated attackers to access sensitive information from non-public posts. This happens because the plugin's REST route does not properly check permissions and passes user-supplied parameters directly to WordPress functions, exposing fields like raw content, passwords, and metadata.

Detection Guidance

Check if the WP Popular Posts plugin is installed and its version is up to 7.4.2. Look for unauthorized access to sensitive fields via the REST API endpoint. Review server logs for unusual requests to /wp-json/wp/v2/popular-posts or similar endpoints with context=edit parameter.

Impact Analysis

Attackers could extract sensitive data from private posts, including drafts or restricted content. This may lead to data breaches, unauthorized access to confidential information, or exposure of internal WordPress configurations.

Compliance Impact

This vulnerability could violate compliance requirements by exposing personal or sensitive data. GDPR and HIPAA mandate strict data protection; unauthorized access risks fines, legal penalties, and reputational damage due to non-compliance.

Mitigation Strategies

Update the WP Popular Posts plugin to the latest version beyond 7.4.2. If an update is unavailable, disable the plugin immediately. Restrict access to the REST API endpoint by modifying server rules or using a web application firewall to block requests with context=edit.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart