The f(x) Private Site plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 1.2.1. This flaw allows unauthenticated remote attackers to retrieve protected page and post content through the plugin's API, bypassing intended access controls. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact limited to partial information disclosure without integrity or availability impact. No patch or official fix has been documented at this time.

An attacker can obtain content from pages and posts that are meant to be protected by the f(x) Private Site plugin, potentially leading to unauthorized disclosure of sensitive site information. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting API access through other means such as web application firewalls or disabling the plugin if feasible to prevent unauthorized content disclosure.