CVE-2026-78149: Smart Post WordPress Information Disclosure

CVE-2026-78149 Overview

CVE-2026-78149 is an information disclosure vulnerability in the Smart Post WordPress plugin versions prior to 4.0.8. The plugin exposes an unauthenticated AJAX action that returns post content and the associated password without first verifying whether the requested post is password protected. Attackers can query the endpoint directly to retrieve restricted post bodies and the plaintext passwords that gate them. The flaw is categorized as Information Exposure [CWE-200] and is exploitable remotely over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can read password-protected WordPress post content and harvest the stored passwords through a single AJAX request.

Affected Products

Smart Post WordPress plugin versions prior to 4.0.8
WordPress sites with the vulnerable plugin installed and activated
Any site relying on Smart Post to gate content behind post passwords

Discovery Timeline

2026-09-05 - CVE-2026-78149 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78149

Vulnerability Analysis

The Smart Post plugin registers an AJAX action that is accessible to unauthenticated users through the standard WordPress wp-admin/admin-ajax.php endpoint. The handler retrieves a post by identifier and returns both the post content and its associated password field. The handler does not check the post's post_password state or enforce the standard WordPress password prompt workflow before serving the response.

Because the endpoint returns the stored password itself, an attacker who reads the response can also authenticate to any other interface that trusts that same password. The disclosure therefore extends beyond the single request and compromises the confidentiality control for the affected posts.

Root Cause

The root cause is a missing authorization check [CWE-200] in the AJAX handler. WordPress exposes a post_password_required() function that plugins are expected to consult before returning gated content. Smart Post versions prior to 4.0.8 omit this check and unconditionally serialize the post row, including the post_password column, into the AJAX response.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker sends an HTTP POST request to admin-ajax.php with the vulnerable action name and a target post identifier. The server responds with the protected content and password in the response body. The vulnerability mechanism is documented in the WPScan Vulnerability Report; no verified public exploit code is available at this time.

Detection Methods for CVE-2026-78149

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing Smart Post plugin AJAX actions
HTTP responses from admin-ajax.php containing post_password field values or the contents of posts marked as password protected
Repeated requests iterating through sequential post ID parameters against the AJAX endpoint

Detection Strategies

Review web server access logs for unauthenticated requests to admin-ajax.php with Smart Post action parameters
Deploy web application firewall rules that inspect AJAX responses for the string post_password returned to unauthenticated sessions
Correlate spikes in admin-ajax.php traffic volume from a single source IP with WordPress plugin inventory data

Monitoring Recommendations

Monitor outbound response sizes from admin-ajax.php for anomalies suggesting bulk content extraction
Alert on any 200-OK response from the Smart Post AJAX action originating from unauthenticated sessions
Track plugin version inventory across WordPress installations to identify hosts still running Smart Post below 4.0.8

How to Mitigate CVE-2026-78149

Immediate Actions Required

Update the Smart Post WordPress plugin to version 4.0.8 or later on all affected sites
Rotate any post passwords that were configured while a vulnerable version was deployed, since the stored values may have been exposed
Audit admin-ajax.php access logs for suspicious enumeration of post identifiers prior to patching

Patch Information

The vendor addressed the issue in Smart Post version 4.0.8 by adding the missing authorization check before returning post content and password data. Refer to the WPScan Vulnerability Report for the advisory details and remediated version reference.

Workarounds

Deactivate and remove the Smart Post plugin until it can be upgraded to a fixed version
Restrict access to admin-ajax.php at the web application firewall for the specific vulnerable action name
Replace post-password gating with an authenticated role-based access mechanism for sensitive content

bash

# Configuration example: block the vulnerable AJAX action at the WAF layer
# Example ModSecurity rule (adapt action name to the plugin's registered handler)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1078149,phase:2,deny,status:403,msg:'Block Smart Post CVE-2026-78149'"
  SecRule ARGS:action "@rx ^smart_post_" "t:lowercase"