The WP-Recall plugin for WordPress suffers from an information exposure vulnerability (CWE-200) due to improper access controls on the 'feed' shortcode. This flaw permits unauthenticated users to view content from posts that should be restricted, including password protected, private, or draft posts. The issue affects all plugin versions up to 16.26.10. The CVSS 3.1 base score is 4.3 (medium severity) with attack vector network, low attack complexity, low privileges required, no user interaction, and limited confidentiality impact. No patch or remediation details are provided in the available data.

An attacker without authentication can access sensitive content from restricted posts, potentially exposing confidential or private information. The impact is limited to confidentiality with no integrity or availability effects. This could lead to privacy violations or leakage of sensitive data stored in protected posts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or disabling the 'feed' shortcode functionality or limiting access to the plugin features to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.