Executive brief
The YMC Smart Filter plugin for WordPress, which provides advanced filtering capabilities for website content, contains a security flaw that allows unauthorized access to sensitive information. An attacker can exploit this to view the titles and full content of private posts and unpublished drafts without needing a password. This could lead to the exposure of confidential business information, upcoming announcements, or internal communications before they are intended for public release.
Technical details
The YMC Smart Filter plugin fails to implement proper authorization checks on its REST API endpoint located at /wp-json/ymc/v1/posts/filter. The endpoint accepts a 'post_status' parameter within the JSON request body that is not validated against the user's permissions. By sending a crafted POST request with 'post_status' set to 'private' or 'draft', an unauthenticated remote attacker can bypass standard WordPress visibility restrictions. This allows for the bulk retrieval of non-public post data, including titles and rendered content. The vulnerability is addressed in version 3.11.3.
Affected products
- YMC Filter YMC Smart Filter < 3.11.3
Timeline
- 2026-06-05: disclosed: Publicly published by WPScan
- 2026-06-26: advisory: CVE published to NVD