The WP Popular Posts plugin allows an attacker who does not authenticate to retrieve private post data via the WordPress REST API. The plugin registers a REST route whose permission_callback always returns true and forwards the client‑supplied “context” (e.g., context=edit) directly to WP_REST_Posts_Controller::prepare_item_for_response() without running the normal read‑permission checks. Because the underlying query accepts any post_type value and does not enforce public or show_in_rest visibility flags, an unauthenticated user can read sensitive fields such as raw title, raw content, password, meta, status, and guid from posts that WordPress core normally keeps hidden, including non‑public block patterns.

All installations of the WP Popular Posts WordPress plugin at version 7.4.2 or earlier are affected. The plugin is distributed under the author hcabrera and is used on WordPress sites that enable the REST API to expose post data.

The CVSS score of 5.3 indicates a moderate severity; the EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple web request to the /wp-json/wp/v2/posts endpoint with the context parameter set to edit. No user credentials or elevated privileges are required. The exposed data can aid further attacks by revealing hidden post content or administrative details.