Security Alert Summary
The YMC Filter WordPress plugin before 3.11.3 contains an authorization and input validation issue in one of its REST API endpoints. This allows unauthenticated attackers to access the titles and content of private, draft, and other non-public posts via a crafted request.
CVE Details
- CVE ID: CVE-2026-10823
- Affected component: YMC Filter WordPress plugin
- Affected versions: versions less than 3.11.3
- Published: June 26, 2026 at 7:16:22 AM UTC
- Last modified: June 26, 2026 at 4:17:26 PM UTC
- CVSS v3.1: Base Score 7.5, Severity HIGH,
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- CWE / weakness: Not specified in the provided data
Technical Details
According to the report, the plugin does not properly authorize access to one of its REST API endpoints and fails to validate a user-supplied query parameter. Because the endpoint lacks proper authorization checks and input validation, an unauthenticated request can cause the endpoint to return titles and content for private, draft, and other non-public posts.
The issue stems from missing access control on the REST API endpoint and inadequate validation of the incoming query parameter. The vulnerability enables disclosure of non-public post data without requiring valid credentials or user interaction.
The impact is limited to information disclosure of post content and titles for non-public posts. There is no indication in the provided data that integrity or availability of the site is directly affected by this issue.
How This Could Impact Your Website
On a typical WordPress site, the site owner and internal staff use drafts and private posts to prepare sensitive content or internal communications. An external contractor or contributor who is not authenticated could exploit this vulnerability to retrieve those draft posts and their contents. That exposed content might include internal notes, strategic plans, or contact details that were not intended for public view.
Practical consequences include disclosure of private content and potentially internal email addresses or other contact information that appear in non-public posts. That information could increase the risk of targeted phishing or social engineering against staff and contractors.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual requests to REST API endpoints or unexpected data access patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
