WordPress Vulnerabilities
WP < 7.1.3 - Unauthenticated Private Post Comment Disclosure via RSS Feed
Description
WordPress does not properly restrict access to the comments associated with private and unpublished posts in some cases, which could allow unauthenticated users to read those comments through a feed.
Affects WordPress
References
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Ananda Dhakal (Patchstack)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-06 (about 25 days ago)
Added
2026-10-06 (about 24 days ago)
Last Updated
2026-10-06 (about 24 days ago)