The YMC Filter WordPress plugin before version 3.11.3 contains an authorization flaw that allows access to a REST API endpoint without authentication. The endpoint accepts a user‑supplied query parameter that is not validated, permitting unauthenticated retrieval of titles and raw content for posts that are normally private, in draft status, or otherwise not publicly accessible. This results in a direct confidentiality breach of non‑public content.

The vulnerability targets the YMC Filter WordPress plugin, specifically versions released prior to 3.11.3. Site owners or administrators using any earlier release of this plugin are affected, regardless of the hosting environment, as the flaw is inherent to the plugin code rather than the server configuration.

An EPSS score of < 1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the endpoint is unauthenticated, any user who can reach the WordPress site can potentially enumerate private or draft posts. While the exploit does not require elevated privileges or code execution, it compromises the confidentiality of content that should remain hidden from the public. The CVSS score of 7.5 still indicates high severity.