CVE-2025-4390

Description

The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.

PUBLISHED Reserved 2025-05-06 | Published 2025-08-12 | Updated 2025-08-13 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Timeline

Credits

Luca Epifanio finder

References

www.wordfence.com/...-1548-4b77-a484-d7c51d829792?source=cve

plugins.trac.wordpress.org/...-wppcp-private-posts-pages.php

plugins.trac.wordpress.org/...-wppcp-private-posts-pages.php

cve.org (CVE-2025-4390)

nvd.nist.gov (CVE-2025-4390)

Download JSON