Junglewise Threat Intelligence

CVE-2026-9013: Rock Lobster Bogo sensitive information exposure in REST API

CVE-2026-9013 · Severity: medium · CVSS 4.3 · Published 2026-06-19

Executive brief

Bogo, a multilingual plugin for WordPress, contains a security flaw that allows low-level users to view private or draft content. By requesting a translation of a restricted post, an attacker with a basic account can bypass permission checks to see the raw title, content, and excerpts of private or password-protected posts. This could lead to the exposure of sensitive internal drafts or confidential business information.

Technical details

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the 'bogo_rest_create_post_translation' function. The vulnerability stems from a missing authorization check (CWE-862) that allows authenticated attackers with subscriber-level access to trigger the duplication of posts via the translation endpoint. By requesting a translation of a post written in a non-default locale into the site's default locale, attackers can bypass locale-based permission gates. The API response then returns the 'title.raw', 'content.raw', and 'excerpt.raw' fields of the duplicated post, exposing the contents of private, draft, or password-protected posts. While subscribers can trigger the duplication, the impact is most significant for Contributor-level users who can read the resulting duplicated content. A fix was introduced in subsequent versions by enhancing the 'permission_callback' to verify 'create_posts' and 'edit_post' capabilities.

Affected products

  • rocklobsterinc Bogo <= 3.9.1

Timeline

  • 2026-05-29: patched: Fix merged into master branch via Pull Request 382
  • 2026-06-19: disclosed: CVE published to NVD

References