CVE-2025-4390: WP Private Content Plus Info Disclosure

CVE-2025-4390 Overview

CVE-2025-4390 is a sensitive information exposure vulnerability in the WP Private Content Plus plugin for WordPress. The flaw affects all versions up to and including 3.6.2 and resides in the validate_restrictions function. Unauthenticated attackers can extract the content of restricted posts through archive and feed pages, bypassing the plugin's access controls. The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and stems from improper enforcement of content restrictions in specific WordPress output contexts.

Critical Impact
Unauthenticated remote attackers can read restricted post content through WordPress archive and feed pages without any authentication or user interaction.

Affected Products

WP Private Content Plus plugin for WordPress
All versions up to and including 3.6.2
WordPress sites using the plugin to restrict post visibility

Discovery Timeline

2025-08-12 - CVE-2025-4390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4390

Vulnerability Analysis

The WP Private Content Plus plugin restricts access to designated posts and pages based on user roles or membership. The plugin enforces these restrictions through the validate_restrictions function defined in class-wppcp-private-posts-pages.php. The function is intended to filter restricted content before it is rendered to unauthorized users.

The restriction logic fails to apply consistently across WordPress output contexts. Archive pages and RSS/Atom feeds render restricted post content in full to unauthenticated visitors. Attackers do not need credentials, tokens, or any prior interaction with the site. A simple HTTP GET request to a category archive, tag archive, or feed endpoint returns the protected content.

Root Cause

The validate_restrictions function does not evaluate the request context when applying restriction checks. Content filtering hooks bound to the singular post view do not fire during archive queries or feed generation. As a result, the raw post content is passed to output routines without redaction. See the WordPress Private Content Class Code at line 138 and line 211 for the affected code.

Attack Vector

An attacker sends unauthenticated HTTP requests to WordPress archive URLs such as /category/{name}/, /tag/{name}/, /author/{name}/, or feed endpoints such as /feed/ and /?feed=rss2. If restricted posts fall within the queried taxonomy or feed scope, the plugin returns their full content in the response. No exploit tooling is required; standard web clients such as curl or a browser suffice. Refer to the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2025-4390

Indicators of Compromise

Unauthenticated HTTP GET requests to /feed/, /feed/rss2/, or category and tag archive URLs from unfamiliar IP addresses.
Elevated request volume to archive and feed endpoints that historically receive minimal traffic.
Responses containing restricted post titles or excerpts in server access logs where the requester lacks a valid session cookie.

Detection Strategies

Audit WordPress access logs for anonymous requests targeting feed and archive endpoints on sites running WP Private Content Plus 3.6.2 or earlier.
Compare rendered archive and feed output against the plugin's configured restriction list to identify content leakage.
Deploy web application firewall rules that flag repeated feed and archive enumeration originating from a single source.

Monitoring Recommendations

Ingest WordPress and web server logs into a central analytics platform and alert on spikes in feed endpoint traffic.
Track the installed plugin version across managed WordPress sites and flag any instance running 3.6.2 or earlier.
Monitor outbound scraping patterns such as sequential archive pagination requests from the same client.

How to Mitigate CVE-2025-4390

Immediate Actions Required

Update WP Private Content Plus to a version later than 3.6.2 on all affected WordPress sites.
If a patched release is not yet available, deactivate the plugin until the vendor publishes a fix.
Review archive and feed output for restricted content and rotate any credentials or sensitive data that may have been exposed.

Patch Information

The vulnerability affects all versions of WP Private Content Plus up to and including 3.6.2. Administrators should upgrade to the latest release published on the WordPress plugin repository. Verify the fix by confirming that restricted posts no longer appear in archive listings or feed output after the update. Consult the Wordfence Vulnerability Analysis for the latest remediation guidance.

Workarounds

Disable RSS and Atom feeds site-wide by filtering feed_content_type or returning early from feed template hooks.
Exclude restricted post categories from archive queries using the pre_get_posts action to remove sensitive content from unauthenticated views.
Restrict access to /feed/ and archive URLs at the reverse proxy or WAF layer until the plugin is updated.

bash

# Example: block feed access at the nginx layer until patched
location ~* /feed/ {
    return 403;
}