Security Alert Summary
The MPCX Lightbox WordPress plugin versions 1.2.2 through 1.2.5 contain an unauthenticated AJAX action that lacks authorization and post-status checks. This allows unauthenticated visitors to retrieve the title, content, or excerpt of arbitrary posts, including private, draft, pending, trashed, and password-protected posts.
CVE Details
- CVE ID: CVE-2026-87848
- Affected component: MPCX Lightbox WordPress plugin
- Affected versions: 1.2.2 through 1.2.5
- Published: September 23, 2026 at 11:17:15 AM
- Last modified: September 23, 2026 at 11:17:15 AM
- CVSS v3.1 base score: 3.7 (LOW)
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N); attack complexity is high (AC:H)
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability exists because an AJAX action exposed by MPCX Lightbox (versions 1.2.2 through 1.2.5) does not implement authentication or authorization checks, and it does not verify the status of the requested post. As a result, unauthenticated requests to that action can return the title, content, or excerpt for arbitrary posts.
The CVE description indicates the issue affects posts in private, draft, pending, trashed, and password-protected states as well as public posts. No specific PHP function names or REST endpoints are provided in the data, so no endpoint names are listed here.
Impact is limited to disclosure of post data. There is no indication in the provided data that this vulnerability allows modification of content, code execution, or denial of service.
How This Could Impact Your Website
In a typical small- to medium-sized site, multiple users interact with WordPress: a site owner, internal staff (editors or contributors), and external contractors or guest authors. If an unauthenticated visitor can retrieve titles, excerpts, or full post content, private or draft material intended only for internal review could be exposed to the public. This could reveal internal discussion, unpublished announcements, or other sensitive information.
Practical consequences include potential exposure of internal or personally identifying information contained in post bodies or excerpts, and an increased risk of targeted phishing or social engineering if attacker-controlled parties can harvest details for recon. If the site stores emails or other contact details inside posts or drafts, those could be read by an attacker.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Temporarily reduce public exposure of sensitive drafts and private posts until you can confirm the plugin has been updated or the action is secured.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can create drafts or private posts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior or repeated requests to AJAX endpoints that return post data.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
