The vulnerability exists in the My Private Site WordPress plugin before version 4.2.3 and results from a failure to apply the administrator‑defined site‑privacy access control to specific unauthenticated front‑end read surfaces. As a consequence, anyone can request RSS feeds or the sitemap and receive the full post content, comments, and URLs that should be restricted behind a mandatory login. This unauthorized disclosure compromises the confidentiality of private content and represents an information‑disclosure flaw that aligns with CWE‑200 as well as a failure of proper access control (CWE‑284).

All installations of the My Private Site WordPress plugin older than version 4.2.3 are affected. No further granularity is provided in the source, so every release prior to 4.2.3 should be considered vulnerable.

The attack surface is exposed through publicly available RSS feeds and sitemap endpoints, requiring no authentication or privileged access. Because the exploit is a simple unauthenticated request, the practical exploitability remains high even in the absence of an EPSS measurement. The vulnerability is not listed in the CISA KEV catalog, but the potential to reveal private site content—especially in environments that rely on a mandatory login for privacy—makes the risk significant for affected sites.