Skip to content
Sign in
7.5 High

CVE-2026-10823 The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and…

Description

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

Affected products and versions

Product Affected versions Fixed in
YMC Filter 3.11 earliest → < 3.11.3 3.11.3

Other CVEs of YMC Filter

The 3 CVEs of YMC Filter →
CVE-2026-16559 The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload… 6.8 Medium CVE-2026-16558 The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it… 5.4 Medium
Track this CVE