Custom Related Posts WordPress Plugin Missing Authorization Vulnerability

A vulnerability exists in the Custom Related Posts plugin for WordPress, affecting all versions through 1.7.3. The issue arises from a lack of proper capability checks on three AJAX actions, allowing authenticated attackers with Subscriber-level access and above to unauthorized access and modification of data. Exploitation of this vulnerability enables these attackers to search private posts and manipulate related post relationships.

Impact

Exploitation allows for unauthorized access to private posts and the ability to link or unlink post relationships, potentially disrupting content organization and visibility.

Remediation

Users are advised to update the Custom Related Posts plugin to version 1.7.4 or later.