VulnSocial

CVE-2026-9013Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt, and password of any private, draft, or password-protected post by triggering its duplication via the translation endpoint and reading the returned title.raw, content.raw, and excerpt.raw fields of the duplicated post. This vulnerability is exploitable against posts written in a non-default locale, as authenticated subscribers can request a translation into the site's default locale to pass the locale-only permission gate. While subscribers can trigger the endpoint, this is only impactful at the Contributor-level as they can actually read the duplicated content.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-06-19: 3Technical Details · 2026-06-19: 306-19
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-9013 The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. Thi… https://www.cve.org/CVERecord?id=CVE-2026-9013 ----- Traducción: CVE-2026-9013 El … http://infoflow.cloud`

    Post summary

    The tweet announces CVE‑2026‑9013, detailing Sensitive Information Exposure in the Bogo WordPress plugin up to version 3.9.1, and links to the official CVE record, but provides no PoC, exploit, patch, or evidence of active exploitation.

    0000031
    82 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-9013 The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. Thi… https://www.cve.org/CVERecord?id=CVE-2026-9013

    Post summary

    A new vulnerability (CVE-2026-9013) in the WordPress Bogo plugin is disclosed, exposing sensitive information through the bogo_rest_create_post_translation endpoint in affected versions up to 3.9.1.

    00000181
    57.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-9013 Sensitive Information Exposure in Bogo WordPress Plugin Versions U... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9013 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    A new vulnerability (CVE-2026-9013) affecting the Bogo WordPress plugin is announced, highlighting sensitive information exposure, with additional alert subscription links provided.

    0000046
    4.1K followersView on X

Explore more

Back to dashboard