CVE-2026-10823

published 2026-06-26

CVE-2026-10823: The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query…

Priority P2 60 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

Detection & IOCs extracted from sources · hover to see the quote

url /wp-json/ymc/v1/posts/filter↗

path /plugins/ymc-smart-filter/↗

command {"params":{"filter_id":1,"post_status":"draft"}}↗

command {"params":{"filter_id":1,"post_status":"publish"}}↗

• → Detect unauthenticated POST requests to the vulnerable REST API endpoint /wp-json/ymc/v1/posts/filter with a JSON body containing 'post_status' set to non-public values (e.g., 'draft', 'private'). A successful exploit returns HTTP 200 with a JSON body containing '"success":true' and 'post-card'. ↗
• → Flag POST requests to /wp-json/ymc/v1/posts/filter that lack authentication headers (no Authorization, no WordPress nonce) and include a 'post_status' parameter in the JSON payload — this is the exploit pattern for unauthenticated post disclosure. ↗
• → Use the PublicWWW fingerprint query '/plugins/ymc-smart-filter/' to identify WordPress sites running the vulnerable YMC Filter plugin (versions before 3.11.3) for targeted scanning. ↗
• → A two-stage probe is used: first confirm the endpoint is live with post_status=publish (HTTP 200 + success:true), then confirm exploitation with post_status=draft returning post-card content. Both stages require no authentication. ↗

• · The exploit uses filter_id:1 as a hardcoded value in the proof-of-concept; actual exploitation may enumerate other filter IDs to retrieve content from different post sets. ↗
• · Vulnerability only affects YMC Filter WordPress plugin versions strictly before 3.11.3; version 3.11.3 and later are patched and should not be flagged. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200