CVE-2026-9013: Bogo WordPress Plugin Sensitive Information Exposure Vulnerability

Technical summary

CVE-2026-9013 is a sensitive information exposure vulnerability in the Bogo WordPress plugin's REST API endpoint 'bogo_rest_create_post_translation'. The endpoint handles post duplication during translation workflows but fails to properly enforce access controls on private, draft, and password-protected posts. When a post in a non-default locale is duplicated via translation to the default locale, the API returns the duplicated post with raw fields (title.raw, content.raw, excerpt.raw) exposed in the JSON response. Although the endpoint requires authentication, the permission check only validates locale access rather than post visibility status. Subscribers can trigger the endpoint but cannot read the result; however, contributors with read access to the translation functionality can extract and view sensitive post content they should not have permission to access. The vulnerability stems from CWE-862 (Missing Authorization) in the REST endpoint logic.

Business impact

For WordPress site operators, this vulnerability creates a confidential information leak risk proportional to the sensitivity of draft, private, or password-protected content on the site. Organizations using Bogo to manage multilingual sites may have internal strategy documents, unreleased product announcements, client-specific posts, or other sensitive material in draft status. A malicious contributor or compromised contributor account can systematically extract this content. The risk is elevated for sites where non-public posts contain competitive, legal, financial, or client information. Exposure is limited to authenticated users, but the low barrier to entry (basic contributor access) widens the attack surface compared to admin-only flaws.

Affected systems

WordPress sites running the Bogo plugin in any version up to and including 3.9.1 are affected. The vulnerability is present in all affected versions without differentiation. Sites that do not use Bogo, or have already upgraded past 3.9.1, are not vulnerable. The scope is limited to multisite or single-site WordPress installations with Bogo active and at least one contributor-level user who might be compromised or malicious. Sites with minimal draft/private post activity or no multilingual content reduce the practical impact, though the technical vulnerability remains present.

Exploitability

Exploitation requires valid WordPress authentication (subscriber level or higher to trigger the endpoint) and knowledge that private or draft posts exist in a non-default language. The attacker must request translation of such posts to the default locale, which is trivial once authenticated. No sophisticated tooling, user interaction, or out-of-band communication is required. The low technical barrier and lack of complexity (CVSS AC:L) make this accessible to anyone with a basic contributor account. However, practical extraction and understanding of sensitive content requires at least contributor-level read access, narrowing the real-world impact. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Administrators should upgrade the Bogo plugin to the first version after 3.9.1 that includes a patch. Review the plugin's official repository or vendor security advisory to confirm the patched version number. Until patching is possible, administrators can reduce risk by restricting contributor-level access to users who are trusted and actively supervised, and by auditing which private or draft posts currently exist in non-default languages. Temporarily disabling the translation feature for sensitive posts or reducing the number of users with contributor privileges are interim mitigation options. A post-incident review should audit contributor accounts for any unauthorized translation API calls in access logs.

Patch guidance

Check the official Bogo plugin page on WordPress.org for an available security update newer than version 3.9.1. Update the plugin via the WordPress admin dashboard once a patched version is released. Before deploying to production, test the update on a staging environment to ensure it does not break translation workflows. Review the plugin changelog and security advisory to understand what permission checks were added or corrected. If no patch is available, continue monitoring the official plugin support channels for release announcements.

Detection guidance

Monitor REST API access logs for requests to the bogo_rest_create_post_translation endpoint, particularly from contributor or subscriber accounts. Baseline legitimate translation traffic first, then flag anomalies such as repeated translation requests targeting the same posts, translation requests outside normal business hours, or requests from newly created or rarely-active accounts. Examine POST request parameters to identify which posts are being targeted for translation. Use WordPress security plugins with REST API logging to capture this data. Additionally, audit the WordPress posts table or revision history for unexpected duplication or access of private/draft posts by non-admin users around the time of suspected exploitation.

Why prioritize this

This vulnerability merits attention due to its direct access to confidential post content, but should not block other critical patching efforts. The CVSS score of 4.3 reflects low-to-medium severity: it requires authentication and network access, and only exposes data without enabling modification or denial of service. Prioritize patching based on: (1) whether your site uses Bogo, (2) the sensitivity of draft/private content on your site, and (3) the number and trustworthiness of contributor-level users. Organizations managing highly sensitive unpublished content should prioritize this higher; those with few drafts and strictly controlled contributor access can deprioritize slightly while awaiting the patch.

Risk score, explained

The CVSS v3.1 base score of 4.3 (MEDIUM) reflects a network-accessible vulnerability requiring valid authentication (PR:L), low complexity attack (AC:L), no user interaction (UI:N), and low confidentiality impact (C:L) with no integrity or availability impact. The score correctly captures that this is a credential-based information leak affecting data confidentiality rather than system stability. The score does not account for environmental factors such as how many contributor users exist on a given site or the criticality of the content at risk; organizations should adjust their internal risk rating based on these factors.

Frequently asked questions