CVE-2026-78149

MediumCVSS 5.3/10Last modified Sep 8, 2026

Description

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 5, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-78158.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_inde CVE-2026-781502.7The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing us CVE-2026-781515.3The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in CVE-2026-781525.3The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outp CVE-2026-781535.3The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conte CVE-2026-781559.9privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges CVE-2026-781567.4A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/CVE-2026-781577.4A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component CVE-2026-781586.3A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. E CVE-2026-781599.8The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the par CVE-2026-78168.8OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a p CVE-2026-781606.3A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/not