The Graphene WordPress theme (versions up to 2.9.2) contains a missing authorization vulnerability (CWE-862) that permits unauthenticated attackers to retrieve the content of password-protected posts by extracting data from a meta tag in the generated HTML source. This exposure occurs because the theme fails to properly restrict access to sensitive post content, allowing information disclosure without requiring authentication.

An attacker can obtain the content of posts that are intended to be protected by passwords, leading to unauthorized disclosure of potentially sensitive information. The vulnerability does not affect integrity or availability, only confidentiality (partial content disclosure). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or replacing the Graphene theme or restricting access to affected posts through alternative means. Monitor official silverks or WordPress security channels for updates and apply any future patches promptly.