The Smart Post WordPress plugin before version 4.0.8 fails to enforce authentication when handling AJAX requests to the sp_handle_post_id action. An attacker can send an unauthenticated request to this endpoint and receive the full content of any password‑protected post in addition to the stored password hash. This directly compromises the confidentiality of protected posts and gives an attacker the credentials needed to view or edit the content thereafter. The flaw resides in an improper access control weakness that allows privileged data to be read by unauthenticated users.

Smart Post WordPress plugin versions 4.0.0 through 4.0.7 installed on WordPress sites are impacted. Sites using any earlier or later patched versions are not affected.

The vulnerability is exploitable over the public network because the AJAX action is reachable without authentication. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of an access check indicates a high risk to confidentiality. The exploit requires only a crafted HTTP request to the AJAX endpoint and is low effort. In practice, any public site running a vulnerable Smart Post installation could have protected content exposed until the plugin is updated.