The Context Blog WordPress theme contains an information exposure flaw in all versions up to and including 1.2.5. The vulnerability is triggered by the unprotected 'context_blog_modal_popup' AJAX endpoint, which lacks proper permission checks. As a result, unauthenticated users can read the content of password‑protected, private, or draft posts that they should not have access to, thereby compromising confidentiality of the site’s internal data.

The bug affects the Context Blog theme supplied by PostMagThemes for WordPress. All releases up to version 1.2.5 are impacted. The issue is limited to sites that have installed this theme and have the modal‑popup feature enabled.

The CVSS score of 5.3 indicates a moderate severity and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is straightforward: any unauthenticated visitor who can reach the modal‑popup endpoint can request private or draft content. No privileged access or complex configuration is required, but the presence of the theme is a prerequisite for exploitation.