The Content Control plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in all versions up to 2.1.0. This flaw allows unauthenticated remote attackers to retrieve sensitive post metadata and published content through the plugin's API. The vulnerability does not require authentication or user interaction and has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with low complexity and no privileges required. The exposure is limited to published content and metadata, with no reported impact on data integrity or availability.

An attacker can obtain sensitive information such as post titles, IDs, slugs, statuses, and published post content without authentication. This could lead to unintended disclosure of content that site owners intended to restrict. There is no evidence of further impact such as modification or deletion of content, or denial of service. The vulnerability affects confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, consider restricting access to the plugin's API endpoints or disabling the plugin if feasible to prevent unauthorized information disclosure.