The Search & Filter Pro plugin for WordPress contains a missing capability check in its get_meta_values function that allows authenticated users with Subscriber level access and above to read arbitrary post meta data. This introduces a data‑exposure vulnerability that could expose sensitive content stored as custom fields, compromising the confidentiality of site information.

This flaw affects WordPress sites that have the Search & Filter Pro plugin installed in versions up to and including 2.5.19.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate as a user with Subscriber or higher capability and then trigger the vulnerable function, typically via a crafted request to the plugin’s get_meta_values endpoint. Because the attack can be performed over the network by an authenticated account, it is limited to users that already have site access but can still expose hidden data.