The Custom Related Posts plugin for WordPress suffers from a missing capability check (CWE-862) on three AJAX endpoints in all versions up to and including 1.7.3. This flaw permits authenticated users with low-level privileges (Subscriber and above) to perform unauthorized data access and modification, specifically searching posts and managing related post links. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium impact with network attack vector, low attack complexity, and no user interaction required.

An attacker with Subscriber-level access can exploit this vulnerability to access and modify data related to post relations within the plugin. This could lead to unauthorized changes in how posts are linked or related, potentially affecting site content integrity. There is no indication of impact on confidentiality beyond limited data exposure, nor on availability. No known exploits are reported in the wild.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level user capabilities if possible or disable the plugin if unauthorized post relation modifications pose a risk.