{"id":"CVE-2023-7199","aliases":["EUVD-2023-59380","GHSA-f44w-wxhf-f354"],"status":"published","title":"Relevanssi (Free \u003c 4.22.0, Premium \u003c 2.25.0) - Unauthenticated Private/Draft Post Disclosure","description":"The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00616,"percentile":0.49781,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2024-01-29T14:44:19Z","modified":"2026-06-17T06:52:17Z","products":[{"vendor":"relevanssi","product":"relevanssi"},{"vendor":"unknown","product":"relevanssi"},{"vendor":"unknown","product":"relevanssi premium"}],"references":[{"url":"https://wpscan.com/vulnerability/0c96a128-4473-41f5-82ce-94bba33ca4a3/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.relevanssi.com/release-notes/premium-2-25-free-4-22-release-notes/","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7199"},{"url":"https://wpscan.com/vulnerability/0c96a128-4473-41f5-82ce-94bba33ca4a3"},{"url":"https://www.relevanssi.com/release-notes/premium-2-25-free-4-22-release-notes"},{"url":"https://github.com/advisories/GHSA-f44w-wxhf-f354"}],"sources":{"cve":[{"id":"CVE-2023-7199","title":"Relevanssi (Free \u003c 4.22.0, Premium \u003c 2.25.0) - Unauthenticated Private/Draft Post Disclosure","description":"The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request","status":"published","published":"2024-01-29T14:44:19.919Z","modified":"2025-05-29T15:09:51.643Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:34.170609Z"}],"euvd":[{"id":"EUVD-2023-59380","description":"The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request","status":"published","published":"2024-01-29T14:44:19Z","modified":"2025-05-29T15:09:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:35.425302Z"}],"ghsa":[{"id":"GHSA-f44w-wxhf-f354","title":"The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0...","description":"The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request","status":"published","published":"2024-01-29T15:30:30Z","modified":"2025-05-29T18:32:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:02:30.221111Z"}],"nvd":[{"id":"CVE-2023-7199","description":"The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request","status":"published","published":"2024-01-29T15:15:09.897Z","modified":"2026-06-17T06:52:17.903Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}