WordPress Vulnerabilities

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description

WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access.

Affects WordPress

7.1
Fixed in WordPress 7.1.1
7.0.4
Fixed in WordPress 7.0.5
7.0.3
Fixed in WordPress 7.0.5
7.0.2
Fixed in WordPress 7.0.5
7.0.1
Fixed in WordPress 7.0.5
7.0
Fixed in WordPress 7.0.5
6.9.7
Fixed in WordPress 6.9.8
6.9.6
Fixed in WordPress 6.9.8
6.9.5
Fixed in WordPress 6.9.8
6.9.4
Fixed in WordPress 6.9.8
6.9.3
Fixed in WordPress 6.9.8
6.9.2
Fixed in WordPress 6.9.8
6.9.1
Fixed in WordPress 6.9.8
6.9
Fixed in WordPress 6.9.8
6.8.8
Fixed in WordPress 6.8.9
6.8.7
Fixed in WordPress 6.8.9
6.8.6
Fixed in WordPress 6.8.9
6.8.5
Fixed in WordPress 6.8.9
6.8.4
Fixed in WordPress 6.8.9
6.8.3
Fixed in WordPress 6.8.9
6.8.2
Fixed in WordPress 6.8.9
6.8.1
Fixed in WordPress 6.8.9
6.8
Fixed in WordPress 6.8.9
6.7.7
Fixed in WordPress 6.7.8
6.7.6
Fixed in WordPress 6.7.8
6.7.5
Fixed in WordPress 6.7.8
6.7.4
Fixed in WordPress 6.7.8
6.7.3
Fixed in WordPress 6.7.8
6.7.2
Fixed in WordPress 6.7.8
6.7.1
Fixed in WordPress 6.7.8
6.7
Fixed in WordPress 6.7.8
6.6.7
Fixed in WordPress 6.6.8
6.6.6
Fixed in WordPress 6.6.8
6.6.5
Fixed in WordPress 6.6.8
6.6.4
Fixed in WordPress 6.6.8
6.6.3
Fixed in WordPress 6.6.8
6.6.2
Fixed in WordPress 6.6.8
6.6.1
Fixed in WordPress 6.6.8
6.6
Fixed in WordPress 6.6.8
6.5.10
Fixed in WordPress 6.5.11
6.5.9
Fixed in WordPress 6.5.11
6.5.8
Fixed in WordPress 6.5.11
6.5.7
Fixed in WordPress 6.5.11
6.5.6
Fixed in WordPress 6.5.11
6.5.5
Fixed in WordPress 6.5.11
6.5.4
Fixed in WordPress 6.5.11
6.5.3
Fixed in WordPress 6.5.11
6.5.2
Fixed in WordPress 6.5.11
6.5
Fixed in WordPress 6.5.11
6.4.10
Fixed in WordPress 6.4.11
6.4.9
Fixed in WordPress 6.4.11
6.4.8
Fixed in WordPress 6.4.11
6.4.7
Fixed in WordPress 6.4.11
6.4.6
Fixed in WordPress 6.4.11
6.4.5
Fixed in WordPress 6.4.11
6.4.4
Fixed in WordPress 6.4.11
6.4.3
Fixed in WordPress 6.4.11
6.4.2
Fixed in WordPress 6.4.11
6.4.1
Fixed in WordPress 6.4.11
6.4
Fixed in WordPress 6.4.11
6.3.10
Fixed in WordPress 6.3.11
6.3.9
Fixed in WordPress 6.3.11
6.3.8
Fixed in WordPress 6.3.11
6.3.7
Fixed in WordPress 6.3.11
6.3.6
Fixed in WordPress 6.3.11
6.3.5
Fixed in WordPress 6.3.11
6.3.4
Fixed in WordPress 6.3.11
6.3.3
Fixed in WordPress 6.3.11
6.3.2
Fixed in WordPress 6.3.11
6.3.1
Fixed in WordPress 6.3.11
6.3
Fixed in WordPress 6.3.11
6.2.11
Fixed in WordPress 6.2.12
6.2.10
Fixed in WordPress 6.2.12
6.2.9
Fixed in WordPress 6.2.12
6.2.8
Fixed in WordPress 6.2.12
6.2.7
Fixed in WordPress 6.2.12
6.2.6
Fixed in WordPress 6.2.12
6.2.5
Fixed in WordPress 6.2.12
6.2.4
Fixed in WordPress 6.2.12
6.2.3
Fixed in WordPress 6.2.12
6.2.2
Fixed in WordPress 6.2.12
6.2.1
Fixed in WordPress 6.2.12
6.2
Fixed in WordPress 6.2.12
6.1.12
Fixed in WordPress 6.1.13
6.1.11
Fixed in WordPress 6.1.13
6.1.10
Fixed in WordPress 6.1.13
6.1.9
Fixed in WordPress 6.1.13
6.1.8
Fixed in WordPress 6.1.13
6.1.7
Fixed in WordPress 6.1.13
6.1.6
Fixed in WordPress 6.1.13
6.1.5
Fixed in WordPress 6.1.13
6.1.4
Fixed in WordPress 6.1.13
6.1.3
Fixed in WordPress 6.1.13
6.1.2
Fixed in WordPress 6.1.13
6.1.1
Fixed in WordPress 6.1.13
6.1
Fixed in WordPress 6.1.13
6.0.14
Fixed in WordPress 6.0.15
6.0.13
Fixed in WordPress 6.0.15
6.0.12
Fixed in WordPress 6.0.15
6.0.11
Fixed in WordPress 6.0.15
6.0.10
Fixed in WordPress 6.0.15
6.0.9
Fixed in WordPress 6.0.15
6.0.8
Fixed in WordPress 6.0.15
6.0.7
Fixed in WordPress 6.0.15
6.0.6
Fixed in WordPress 6.0.15
6.0.5
Fixed in WordPress 6.0.15
6.0.4
Fixed in WordPress 6.0.15
6.0.3
Fixed in WordPress 6.0.15
6.0.2
Fixed in WordPress 6.0.15
6.0.1
Fixed in WordPress 6.0.15
6.0
Fixed in WordPress 6.0.15
5.9.16
Fixed in WordPress 5.9.17
5.9.15
Fixed in WordPress 5.9.17
5.9.14
Fixed in WordPress 5.9.17
5.9.13
Fixed in WordPress 5.9.17
5.9.12
Fixed in WordPress 5.9.17
5.9.11
Fixed in WordPress 5.9.17
5.9.10
Fixed in WordPress 5.9.17
5.9.9
Fixed in WordPress 5.9.17
5.9.8
Fixed in WordPress 5.9.17
5.9.7
Fixed in WordPress 5.9.17
5.9.6
Fixed in WordPress 5.9.17
5.9.5
Fixed in WordPress 5.9.17
5.9.4
Fixed in WordPress 5.9.17
5.9.3
Fixed in WordPress 5.9.17
5.9.2
Fixed in WordPress 5.9.17
5.9.1
Fixed in WordPress 5.9.17
5.9
Fixed in WordPress 5.9.17
5.8.15
Fixed in WordPress 5.8.16
5.8.14
Fixed in WordPress 5.8.16
5.8.13
Fixed in WordPress 5.8.16
5.8.12
Fixed in WordPress 5.8.16
5.8.11
Fixed in WordPress 5.8.16
5.8.10
Fixed in WordPress 5.8.16
5.8.9
Fixed in WordPress 5.8.16
5.8.8
Fixed in WordPress 5.8.16
5.8.7
Fixed in WordPress 5.8.16
5.8.6
Fixed in WordPress 5.8.16
5.8.5
Fixed in WordPress 5.8.16
5.8.4
Fixed in WordPress 5.8.16
5.8.3
Fixed in WordPress 5.8.16
5.8.2
Fixed in WordPress 5.8.16
5.8.1
Fixed in WordPress 5.8.16
5.8
Fixed in WordPress 5.8.16
5.7.17
Fixed in WordPress 5.7.18
5.7.16
Fixed in WordPress 5.7.18
5.7.15
Fixed in WordPress 5.7.18
5.7.14
Fixed in WordPress 5.7.18
5.7.13
Fixed in WordPress 5.7.18
5.7.12
Fixed in WordPress 5.7.18
5.7.11
Fixed in WordPress 5.7.18
5.7.10
Fixed in WordPress 5.7.18
5.7.9
Fixed in WordPress 5.7.18
5.7.8
Fixed in WordPress 5.7.18
5.7.7
Fixed in WordPress 5.7.18
5.7.6
Fixed in WordPress 5.7.18
5.7.5
Fixed in WordPress 5.7.18
5.7.4
Fixed in WordPress 5.7.18
5.7.3
Fixed in WordPress 5.7.18
5.7.2
Fixed in WordPress 5.7.18
5.7.1
Fixed in WordPress 5.7.18
5.7
Fixed in WordPress 5.7.18
5.6.19
Fixed in WordPress 5.6.20
5.6.18
Fixed in WordPress 5.6.20
5.6.17
Fixed in WordPress 5.6.20
5.6.16
Fixed in WordPress 5.6.20
5.6.15
Fixed in WordPress 5.6.20
5.6.14
Fixed in WordPress 5.6.20
5.6.13
Fixed in WordPress 5.6.20
5.6.12
Fixed in WordPress 5.6.20
5.6.11
Fixed in WordPress 5.6.20
5.6.10
Fixed in WordPress 5.6.20
5.6.9
Fixed in WordPress 5.6.20
5.6.8
Fixed in WordPress 5.6.20
5.6.7
Fixed in WordPress 5.6.20
5.6.6
Fixed in WordPress 5.6.20
5.6.5
Fixed in WordPress 5.6.20
5.6.4
Fixed in WordPress 5.6.20
5.6.3
Fixed in WordPress 5.6.20
5.6.2
Fixed in WordPress 5.6.20
5.6.1
Fixed in WordPress 5.6.20
5.6
Fixed in WordPress 5.6.20

References

URL
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.2 (low)

Miscellaneous

Original Researcher
hdwsec
Verified
Yes
WPVDB ID
a929978a-4c97-4b2a-8933-cc0cb9e0ea46

Timeline

Publicly Published
2026-09-17 (about 1 month ago)
Added
2026-09-18 (about 1 month ago)
Last Updated
2026-09-18 (about 1 month ago)

Other

Published
Title
Published
2025-12-29
Title
Wallet System for WooCommerce < 2.7.4 - Authenticated (Subscriber+) Information Exposure
Published
2026-08-31
Title
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
Published
2025-01-30
Title
Order Export for WooCommerce < 3.25 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2026-08-10
Title
Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
Published
2025-11-07
Title
Academy LMS Pro < 3.3.9 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'