CVE-2026-10823: YMC Filter WordPress Plugin Authorization Bypass – Private Post Disclosure

Technical summary

CVE-2026-10823 is an authorization bypass and input validation failure in the YMC Filter WordPress plugin versions prior to 3.11.3. The vulnerability resides in a REST API endpoint that fails to enforce proper access controls and does not sanitize or validate a user-supplied query parameter. This permits unauthenticated requests to retrieve the titles and full content of posts marked as private, draft, pending, scheduled, or otherwise non-public. The attack vector is network-based with no authentication required and no user interaction necessary, resulting in confidentiality impact through unrestricted information disclosure.

Business impact

Organizations using the affected YMC Filter plugin may suffer unauthorized exposure of confidential content—including unreleased announcements, internal communications, client work-in-progress, or sensitive editorial drafts. This breach of content confidentiality can result in competitive disadvantage, violation of data protection obligations, reputational harm, or compromise of intellectual property. Additionally, exposed draft content may reveal internal workflows or security-adjacent information useful for further reconnaissance by threat actors.

Affected systems

WordPress sites running the YMC Filter plugin in any version before 3.11.3 are affected. The vulnerability impacts all installations regardless of WordPress version or site configuration, since the flaw exists at the plugin level and is reachable over the network without authentication. Any site that has not updated to version 3.11.3 or later remains vulnerable.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no complex setup, and no user interaction. An attacker needs only to craft a simple HTTP request to the vulnerable REST API endpoint with a malicious query parameter. The attack can be automated and scaled to target multiple WordPress sites. The lack of authentication barriers and straightforward exploitation path make this a high-priority concern for active discovery and compromise by opportunistic attackers.

Remediation

Update the YMC Filter WordPress plugin to version 3.11.3 or later. This version contains fixes for both the authorization bypass and input validation issues. Site administrators should verify the plugin version in their WordPress dashboard and apply the update immediately. After patching, administrators should review access logs if available to determine whether the endpoint was accessed by unauthorized parties prior to remediation.

Patch guidance

Navigate to the WordPress dashboard, go to Plugins, and check for an available update for YMC Filter. Click 'Update Now' to apply version 3.11.3 or later. For sites with automatic updates disabled, manually download and install the plugin from the official WordPress plugin repository or verify against the vendor advisory for the exact patched version. Test the site after updating to ensure no functionality is broken and that private content is no longer exposed via the REST API.

Detection guidance

Monitor web server logs for requests to the YMC Filter REST API endpoints, particularly those containing unusual query parameters or requests from unexpected IP addresses. Look for GET requests to paths containing the plugin slug with API calls made without authentication tokens. WordPress security plugins and WAF solutions may flag or log these requests if configured. Additionally, audit recent access patterns to the REST API and check for suspicious retrieval of private or draft post content by reviewing API request logs if the site has debugging enabled.

Why prioritize this

This vulnerability scores 7.5 (HIGH) on the CVSS scale due to the combination of network accessibility, unauthenticated exploitation, low attack complexity, and direct confidentiality impact. While integrity and availability are not affected, the unrestricted exposure of sensitive content creates material business risk. Organizations should prioritize patching this vulnerability within their normal critical update windows, particularly if their WordPress sites host confidential or proprietary content.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector reflects network attack surface (AV:N), no special conditions required (AC:L), unauthenticated access (PR:N), no user interaction needed (UI:N), and high confidentiality impact (C:H). The absence of integrity and availability impacts prevents a critical rating, but the ease and breadth of exploitation combined with direct information disclosure justifies the HIGH severity classification.

Frequently asked questions