CVE-2026-11781 is an information exposure vulnerability (CWE-200) in the Adminify WordPress plugin versions prior to 4.2.10. The plugin fails to perform proper per-user read-capability checks on the output of one of its administration search features. This flaw enables users with the Contributor role, which normally has limited access, to view sensitive data that should be restricted, including other authors' unpublished post titles, pending comments, the plugin inventory, and user account names. No CVSS score or vendor advisory is available, and no patch status is confirmed.

Unauthorized disclosure of non-public content can occur, potentially exposing unpublished post titles, pending comments, plugin inventory details, and user account names to low-privilege users. This may lead to information leakage that could assist in further attacks or privacy violations. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role access where possible and monitor for updates from the Adminify plugin vendor. Avoid granting Contributor role users access to sensitive administrative features.