The Bogo plugin for WordPress is vulnerable to sensitive information exposure in all versions up to 3.9.1 through the bogo_rest_create_post_translation endpoint. Authenticated users with subscriber level or higher can trigger a duplication of a private, draft, or password‑protected post via the translation endpoint. The response contains fields such as title.raw, content.raw, and excerpt.raw, which expose the original raw title, content, excerpt, and password of the post. This weakness is a missing authorization flaw (CWE‑862). The impact is the disclosure of confidential post data to any authenticated subscriber or higher user, which can compromise confidentiality and potentially integrity if the data is later edited.

WordPress sites that use the Bogo plugin version 3.9.1 or earlier are affected. The plugin is distributed by rocklobsterinc and is widely used in WordPress installations where private or password‑protected posts are managed through Bogo. Any site that hosts such content and has users with subscriber or higher roles is susceptible.

The CVSS score of 4.3 indicates a moderate severity vulnerability. The attack relies on the REST API, which is remotely accessible over HTTPS, and only requires authenticated access with a subscriber role or higher, a common privilege on many sites. Because the EPSS score is not available and the vulnerability is not listed in CISA KEV, current exploitation likelihood is unclear, but the ability to extract private post data presents a clear confidentiality risk to site owners.