CVE-2026-92548Published
WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-92548 · Microsoft / collected KEV context
cve-program · CVE-2026-92548
- https://www.wordfence.com/threat-intel/vulnerabilities/id/09c63c2f-d2d3-4c39-8329-0e0e5b62db98?source=cve
- https://plugins.trac.wordpress.org/browser/wordpress-popular-posts/tags/7.4.2/src/Rest/PostsEndpoint.php#L96
- https://plugins.trac.wordpress.org/browser/wordpress-popular-posts/tags/7.4.2/src/Rest/PostsEndpoint.php#L38
- https://plugins.trac.wordpress.org/browser/wordpress-popular-posts/tags/7.4.2/src/Rest/PostsEndpoint.php#L51
- https://plugins.trac.wordpress.org/browser/wordpress-popular-posts/tags/7.4.2/src/Query.php#L421
- https://plugins.trac.wordpress.org/changeset/3715724/wordpress-popular-posts/trunk
- https://plugins.trac.wordpress.org/changeset/3715724/wordpress-popular-posts/trunk/src/Rest/PostsEndpoint.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.