The vulnerability allows an authenticated attacker with contributor-level access to read titles and publication dates of all private posts site‑wide. The plugin’s check only verifies that the user can edit the parent post the attacker owns, which any contributor can. Consequently, private content that should be visible only to editors or higher roles can be exposed, undermining confidentiality.

WordPress sites running the Related Posts for WordPress plugin version 3.0.0 or earlier. An attacker with contributor or higher privileges can exploit this flaw. The problem is confined to the plugin; other WordPress core functions remain unaffected.

The flaw is assigned a moderate CVSS score of 4.3, and no EPSS data is available, implying an indeterminate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires authenticated access at the contributor level, it cannot be exploited by anonymous users but can be leveraged by anyone who can log in to the site. The inability to block the ‘rp4wp_view’ parameter further increases the risk of sensitive information leakage.