Description
The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.
Published: 2026-07-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Context Blog theme for WordPress contains an issue in its modal‑popup component that, when a post ID is supplied, returns the full content of posts that are password‑protected. Because the page does not require authentication, an attacker can retrieve sensitive material that is intended to remain confidential. The weakness is a classic information‑disclosure flaw and is classified as CWE‑200.

Affected Systems

WordPress sites that are running Context Blog version 1.3.5 or earlier are vulnerable. All installations that include any of the earlier versions listed in the theme’s changelog are potentially affected.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate impact if less than 1 % suggests that the vulnerability is not widely exploited in a post ID, requiring no user authentication.

Generated by OpenCVE AI on July 29, 2026 at 09:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Context Blog theme to a release newer than 1.3.5 that contains the fix for the modal‑popup vulnerability.
  • If an upgrade is not immediately possible, disable or remove the context_blog_modal_popup feature until a patched version is available.
  • Continuously monitor site password‑protected post content and follow up with appropriate incident‑response procedures.

Generated by OpenCVE AI on July 29, 2026 at 09:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 11 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Postmagthemes
Postmagthemes context Blog
Wordpress
Wordpress wordpress
Vendors & Products Postmagthemes
Postmagthemes context Blog
Wordpress
Wordpress wordpress

Sat, 11 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.
Title Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Postmagthemes Context Blog
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-13T14:39:42.665Z

Reserved: 2026-04-21T14:48:11.329Z

Link: CVE-2026-6801

cve-icon Vulnrichment

Updated: 2026-07-13T14:36:34.845Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T09:30:18Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor