WordPress Plugin Vulnerabilities

My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

Description

The plugin does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.

Proof of Concept

Affects Plugins

Plugin icon
jonradio-private-site
Fixed in 4.2.3

References

CVE
CVE-2026-81348

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Shivamani Vastrala
Submitter
Shivamani Vastrala
Verified
Yes
WPVDB ID
54228ea4-eec6-4752-a16e-85209d4445b0

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2022-01-28
Title
Perfect Brands for WooCommerce < 2.0.5 - Subscriber+ Sensitive Information Disclosure
Published
2024-07-26
Title
Add Admin CSS < 2.5 - Unauthenticated Full Path Dislcosure
Published
2024-02-02
Title
Total Upkeep < 1.15.9 - Improper Authorization to Unauthenticated Arbitrary File Download
Published
2026-01-23
Title
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure via wdk_public_action
Published
2026-03-05
Title
Greenshift – animation and page builder blocks < 12.8.4 - Unauthenticated Sensitive Information Exposure via Settings Backup