Unauthenticated disclosure of certain private posts in WordPress

5.8 CVSS

Vulnerability Description

In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-11028

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from WordPress

View All →

CVE-2025-58674

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Medium 5.9

CVE-2025-58246

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Medium 4.3

CVE-2025-54352

WordPress 3.5 through 6.8.2 allows remote attackers to guess titles...

Low 3.7

CVE-2024-31211

Remote Code Execution in `WP_HTML_Token`

Medium 5.5

CVE-2024-31210

PHP file upload bypass via Plugin installer

High 7.7

Affected Vendor

WordPress

View all reports →

Affected Software

WordPress

Vulnerable Versions:

>= 5.4.0, < 5.4.1, >= 5.3.0, < 5.3.3, >= 5.2.0, < 5.2.6, >= 5.1.0, < 5.1.5, >= 5.0.0, < 5.0.9, >= 4.9.0, < 4.9.14, >= 4.8.0, < 4.8.13, >= 4.7.0, < 4.7.17, >= 4.6.0, < 4.6.18, >= 4.5.0, < 4.5.21, >= 4.4.0, < 4.4.22, >= 4.3.0, < 4.3.23, >= 4.2.0, < 4.2.27, >= 4.1.0, < 4.1.30, >= 4.0.0, < 4.0.30, >= 3.9.0, < 3.9.31, >= 3.8.0, < 3.8.33, >= 3.7.0, < 3.7.33