Executive brief
My Private Site is a WordPress plugin that enables administrators to restrict access to a website by requiring mandatory login. The plugin fails to enforce this access control on RSS feeds, comment feeds, and XML sitemaps, allowing unauthenticated visitors to read private post content, comments, and discover private post URLs despite the site being placed behind a login wall. This defeats the site's intended privacy protection and exposes sensitive content.
Technical details
The vulnerability is an access control bypass in the My Private Site WordPress plugin (before version 4.2.3). The plugin applies privacy gates to standard page requests but does not restrict RSS feeds (/feed/), comment feeds (/comments/feed/), and XML sitemaps (wp-sitemap-posts-post-1.xml) from unauthenticated access. An unauthenticated attacker can request these endpoints directly over the network to read private post content, comment bodies, and enumerate private post URLs. The issue specifically affects STANDARD compatibility mode on classic (non-block) WordPress themes; block themes have an additional template_redirect gate that covers these surfaces. The vulnerability was fixed in version 4.2.3.
Affected products
- jonradio My Private Site before 4.2.3
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 4.2.3