VulnSocial

CVE-2026-10823Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-06-29); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-29: 1Mentions · 2026-06-30: 1Technical Details · 2026-06-29: 1Technical Details · 2026-06-30: 106-2906-30
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Halil Deniz@denizhalilT
    Disclosure

    New critical zero-auth vulnerability in WordPress YMC Filter! 🚨 CVE-2026-10823 allows attackers to exploit the REST API to silently leak private data, draft revisions, and password-protected posts without logging in. Read the deep dive: https://denizhalil.com/2026/06/30/cve-2026-10823-ymc-filter-wordpress-vulnerability/ https://t.co/gYKW7NareF

    Post summary

    A new zero‑authentication vulnerability (CVE-2026-10823) in WordPress YMC Filter is disclosed. It enables attackers to pull private content via the REST API, but no exploit, patch, or active exploitation information is provided.

    0002079
    32 followersView on X
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-10823 - high 🚨 YMC Filter WordPress - Unauthenticated Post Disclosure > YMC Filter WordPress plugin < 3.11.3 contains a broken access control vulnerability c... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-10823 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces a high‑severity CVE-2026-10823 affecting YMC Filter WordPress plugin versions below 3.11.3, describing a broken access control issue and linking to a Nuclei detection template.

    00001289
    958 followersView on X

Explore more

Back to dashboard