The REHub - Price Comparison, Multi Vendor Marketplace WordPress theme contains an information exposure vulnerability (CWE-200) in all versions up to and including 19.9.7. The flaw exists in the 'ajax_action_re_getfullcontent' function, which does not properly restrict which posts can be accessed. This allows unauthenticated attackers to retrieve content from password-protected posts that should be inaccessible. The vulnerability has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact without integrity or availability effects. No patch or official fix information is available in the provided data.

An unauthenticated attacker can extract sensitive information from password-protected posts within the affected WordPress theme. This exposure compromises confidentiality but does not affect integrity or availability. The impact is limited to unauthorized reading of protected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected functionality or disabling the vulnerable feature if possible. Monitor vendor channels for updates and apply patches promptly once available.