The WP Private Content Plus plugin for WordPress contains a flaw in the validate_restrictions function that allows any visitor to read sensitive content from restricted posts that appear on archive and feed pages. The vulnerability can expose confidentiality of post body text, media, or other details that were meant to be visible only to authorized users, and it does not grant any code execution or escalation of privileges. The weakened confidentiality is the primary impact.

WordPress sites that have installed WP Private Content Plus plugin versions 3.6.2 or earlier are affected; the vendor nimeshrmr identified the flaw in all releases up to and including 3.6.2. Sites running newer versions are not impacted.

The CVSS score of 5.3 signifies a moderate level of risk. The EPSS score of less than 1% indicates that the exploit probability is currently very low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is unauthenticated and occurs simply by navigating to publicly accessible archive or feed URLs, without requiring any special credentials or pre‑existing attacker access.