The RTMKit plugin for WordPress, prior to version 2.0.9, has a missing capability check in one of its AJAX actions. As a result, users with at least the Contributor role can resolve a request‑supplied post identifier and obtain the titles of other users’ private, draft, pending, scheduled and trashed posts. This is an information‑disclosure flaw, allowing an attacker to leak sensitive post titles but not the full content of the posts. The weakness corresponds to CWE‑639, Inconsistent Authorization. The vulnerability does not enable code execution or privilege escalation, but it provides indirect insight into the site’s private content structure.

All installations of the RTMKit WordPress plugin before version 2.0.9 are affected. Administrators should verify that any instance of the plugin on their sites runs an older release, as the fix was introduced in release 2.0.9.

The CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a crafted AJAX request that bypasses authorization checks; an attacker only needs to be a Contributor or higher to read the leaking titles. Because the attack does not expose post content, the impact is limited to title disclosure, but it could be combined with other discovery techniques to assist in planning further attacks.