The vulnerability exists in the My Private Site WordPress plugin before version 4.2.3 and results from a failure to apply the administrator-defined site-privacy access control to specific unauthenticated front-end read surfaces. As a consequence, anyone can request RSS feeds or the sitemap and receive the full post content, comments, and URLs that should be restricted behind a mandatory login. This unauthorized disclosure compromises the confidentiality of private content and represents an information-disclosure flaw that aligns with CWE-200.

All installations of the My Private Site WordPress plugin older than version 4.2.3 are affected. No further granularity is provided in the source, so every release prior to 4.2.3 should be considered vulnerable.

The likely attack vector is through publicly available RSS feeds and sitemap endpoints, which the plugin fails to protect, as inferred from the description. The exploitation requires no authentication or privileged access. However, the EPSS score of <1% indicates a very low probability of real-world exploitation at present, despite the straightforward nature of the request. With a CVSS score of 3.7, the vulnerability is classified as low to moderate severity. The vulnerability is not listed in the CISA KEV catalog, but the potential to reveal private site content—especially on sites that rely on mandatory login for privacy—makes the risk significant for affected sites.