The WP‑Recall – Registration, Profile, Commerce & More plugin for WordPress contains an information exposure flaw that allows unauthenticated attackers to retrieve content from password protected, private, or draft posts via the 'feed' shortcode. The vulnerability arises because the plugin does not properly restrict which posts may be included, violating the intended access controls. As a result, attackers can read confidential post data, compromising user privacy and content confidentiality.

The affected vendor is WP‑Recall, a WordPress plugin that provides registration, profile, commerce, and related functionality. All versions up to and including 16.26.10 are vulnerable. The flaw resides in the plugin's processing of the 'feed' shortcode, which does not properly restrict which posts may be included.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the current time. The vulnerability does not appear in the CISA KEV catalog, and there are no indications that a public exploit is actively circulating. The likely attack vector involves placing or requesting the 'feed' shortcode from a public page, thereby triggering the plugin to expose restricted post content. While the exploitation requires no special privileges, the impact is limited to inadvertent leakage of post data.