The Related Posts for WordPress plugin allows authenticated users with Contributor or higher permissions to create custom links between posts via a hidden admin page that processes the parameter 'rp4wp_create_link'. The plugin verifies that the user can edit the parent post but does not verify that the child post ID supplied by the attacker is readable by that user. By inserting an arbitrary post ID as the child and later rendering the link titles, an editor can view the title of any non‑public post, including drafts, pending, private, future, or trashed posts authored by users with higher privileges. This exposes sensitive content that should otherwise be hidden.

The vulnerability exists in all releases of the Related Posts for WordPress plugin up through version 3.0.0. Sites with these older plugin versions and users granted Contributor-level or higher access to the WordPress admin area are impacted.

The CVSS score of 4.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, which suggests no high‑profile exploits have been documented. The flaw requires only authenticated Contributor‑level access, so an attacker who can add content can exploit the vulnerability. The exploit does not provide code execution, database access, or server compromise; it only retrieves post titles that would normally be hidden, thereby compromising confidentiality of unpublished content.