{"id":"CVE-2025-4390","aliases":["EUVD-2025-24197","GHSA-rcvj-r8h6-mxfr","UBUNTU-CVE-2025-4390"],"status":"published","title":"WP Private Content Plus \u003c= 3.6.2 - Unauthenticated Sensitive Information Exposure","description":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00363,"percentile":0.30534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2025-08-12T02:24:46Z","modified":"2026-06-17T09:33:10Z","products":[{"vendor":"nimeshrmr","product":"wp private content plus"},{"vendor":"unknown","product":"wp private content plus"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c305546-1548-4b77-a484-d7c51d829792?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-private-content-plus/trunk/classes/class-wppcp-private-posts-pages.php#L138"},{"url":"https://plugins.trac.wordpress.org/browser/wp-private-content-plus/trunk/classes/class-wppcp-private-posts-pages.php#L211"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4390"},{"url":"https://github.com/advisories/GHSA-rcvj-r8h6-mxfr"},{"url":"https://ubuntu.com/security/CVE-2025-4390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-4390","tags":["report"]},{"url":"https://lists.schedmd.com/mailman3/hyperkitty/list/slurm-announce@lists.schedmd.com/message/B73QHKW6TKE2T5KDWVPIWNE5H4KWX667/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-4390","title":"WP Private Content Plus \u003c= 3.6.2 - Unauthenticated Sensitive Information Exposure","description":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.","status":"published","published":"2025-08-12T02:24:46.766Z","modified":"2026-04-08T16:51:11.4Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-24197","description":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.","status":"published","published":"2025-08-12T02:24:46Z","modified":"2026-04-08T16:51:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:59.483414Z"}],"ghsa":[{"id":"GHSA-rcvj-r8h6-mxfr","title":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure...","description":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.","status":"published","published":"2025-08-12T03:31:52Z","modified":"2025-08-12T03:31:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:03:14.349614Z"}],"nvd":[{"id":"CVE-2025-4390","description":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.","status":"published","published":"2025-08-12T03:15:28.763Z","modified":"2026-06-17T09:33:10.403Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:11:22.953396Z"}],"osv":[{"id":"UBUNTU-CVE-2025-4390","description":"The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.","status":"withdrawn","published":"2025-08-12T03:15:00Z","modified":"2025-09-08T17:06:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"}]}}