CVE-2026-9013 Overview
CVE-2026-9013 is a sensitive information exposure vulnerability in the Bogo plugin for WordPress, affecting all versions up to and including 3.9.1. The flaw exists in the bogo_rest_create_post_translation REST endpoint, which fails to enforce proper authorization checks before duplicating posts. Authenticated attackers with subscriber-level access can trigger duplication of private, draft, or password-protected posts written in a non-default locale. While subscribers can invoke the endpoint, exploitation becomes impactful at contributor-level access, where the attacker can read the duplicated post's title.raw, content.raw, excerpt.raw, and password fields. The issue is tracked under [CWE-862] Missing Authorization.
Critical Impact
Authenticated contributor-level users can extract raw titles, content, excerpts, and passwords from private, draft, or password-protected posts via the translation endpoint.
Affected Products
- Bogo plugin for WordPress, all versions up to and including 3.9.1
- WordPress sites with multilingual content using non-default locales
- Sites permitting subscriber or contributor account registration
Discovery Timeline
- 2026-06-19 - CVE-2026-9013 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-9013
Vulnerability Analysis
The Bogo plugin provides multilingual support for WordPress by allowing administrators to create localized translations of posts. The vulnerable endpoint bogo_rest_create_post_translation duplicates a source post into a target locale. The permission callback validates only that the requesting user has rights related to locale operations, not whether the user can read the source post's underlying content.
Authenticated subscribers can invoke the duplication routine against any post written in a non-default locale by requesting translation into the site's default locale. The endpoint then returns the duplicated post object, including the raw fields title.raw, content.raw, and excerpt.raw. At contributor-level and above, the duplicated post is readable by the attacker, exposing content that should remain restricted to authorized editors.
Root Cause
The root cause is a missing authorization check on the source post before duplication. The plugin's REST permission gate evaluates locale eligibility but does not call WordPress capability checks such as read_post against the source object. This is a classic [CWE-862] Missing Authorization pattern, where business logic relies on an incomplete permission model. See the WordPress Plugin Rest-API Code and Post.php Code for the affected logic.
Attack Vector
Exploitation is network-based and requires authenticated access at the subscriber level or higher. The attacker enumerates posts in non-default locales, then issues a POST request to the bogo_rest_create_post_translation endpoint requesting translation into the default locale. The plugin duplicates the source post and returns its raw fields in the JSON response. Contributors and above can then read the duplicated content through the standard WordPress editor or REST API. No user interaction or social engineering is required.
For technical details on the vulnerable code paths and the patch, refer to the GitHub Pull Request Changes and the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2026-9013
Indicators of Compromise
- POST requests to the WordPress REST route /wp-json/bogo/v1/posts/<id>/translation originating from low-privilege user sessions
- Unexpected duplicate posts appearing in the default site locale that mirror existing private, draft, or password-protected content
- Spikes in REST API activity from subscriber or contributor accounts accessing translation endpoints
Detection Strategies
- Review WordPress access logs for calls to the bogo_rest_create_post_translation route by users below the editor role
- Audit the wp_posts table for newly created duplicates with matching post_content or post_title values across locales
- Correlate REST API authentication events with post duplication actions to identify unauthorized translation requests
Monitoring Recommendations
- Enable verbose REST API logging and forward WordPress audit events to a centralized log platform
- Monitor for anomalous account behavior on subscriber and contributor accounts, including unusual REST endpoint access patterns
- Alert on creation of posts containing duplicated content originating from non-default locale source posts
How to Mitigate CVE-2026-9013
Immediate Actions Required
- Update the Bogo plugin to a version newer than 3.9.1 that includes the upstream fix from pull request #382
- Audit existing subscriber and contributor accounts and remove unused or untrusted users
- Review private, draft, and password-protected posts for unauthorized duplication and revoke exposed passwords where applicable
Patch Information
The maintainers addressed the issue in the Bogo plugin repository via the WordPress Plugin Changeset 3574263. The fix adds a proper capability check on the source post within the REST permission callback, ensuring that only users authorized to read the source content can trigger its translation and duplication.
Workarounds
- Disable the Bogo plugin until an upgraded version can be installed if patching is not immediately feasible
- Restrict new account registration and require administrator approval for subscriber and contributor accounts
- Use a web application firewall rule to block REST requests to the Bogo translation endpoint from non-editor roles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
