CVE-2026-10823

YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure

CVSS 7.5 HIGHEPSS 0.9%

Vexday Risk Score

56Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 7.5EPSS 0.9%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

26 Jun 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Unknown · YMC Filter

public PoCs found — 1

cve_referencewpscan.com/vulnerability/b55ebf9e-a05d-4ae4-b653-da7db63e76d2/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/b55ebf9e-a05d-4ae4-b653-da7db63e76d2/