The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site…

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.2%

3. Sep 8, 2026Record revised

   Last analysed / modified upstream

4. Sep 8, 2026CVSS changed

   3.7 → —

5. Sep 8, 2026Severity changed

   low → none

6. Sep 9, 2026CVSS changed

   — → 3.7

7. Sep 9, 2026Severity changed

   none → low

8. Sep 9, 2026CVSS changed

   3.7 → —

9. Sep 9, 2026Severity changed

   low → none

10. Sep 9, 2026CVSS changed

    — → 3.7

11. Sep 9, 2026Severity changed

    none → low

12. Sep 9, 2026CVSS changed

    3.7 → —

13. Sep 9, 2026Severity changed

    low → none

14. Sep 9, 2026CVSS changed

    — → 3.7

15. Sep 9, 2026Severity changed

    none → low

16. Sep 25, 2026EPSS peak

    0.2% → 0.3%

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 3.7
• Sep 9, 2026Severity none → low
• Sep 9, 2026CVSS 3.7 → —
• Sep 9, 2026Severity low → none
• Sep 9, 2026CVSS — → 3.7
• Sep 9, 2026Severity none → low
• Sep 9, 2026CVSS 3.7 → —
• Sep 9, 2026Severity low → none
• Sep 9, 2026CVSS — → 3.7
• Sep 9, 2026Severity none → low
• Sep 8, 2026CVSS 3.7 → —
• Sep 8, 2026Severity low → none