WordPress Plugin Vulnerabilities

PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API

Description

The plugin does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.

Proof of Concept

Affects Plugins

Plugin icon
ultimate-post
Fixed in 5.0.41

References

CVE
CVE-2026-86783

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
719fc130-748b-4bad-8091-2858664299ed

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2024-04-22
Title
Simply Static < 3.1.4 - Unauthenticated Information Exposure
Published
2026-05-28
Title
Smart Online Order for Clover < 1.6.1 - Unauthenticated Sensitive Information Exposure
Published
2026-02-18
Title
Web Accessibility by accessiBe < 2.12 - Unauthenticated Sensitive Information Exposure
Published
2024-11-26
Title
ProfilePress < 4.15.19 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2021-03-26
Title
Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure