CVE-2026-9013 is a missing authorization vulnerability in the Bogo plugin for WordPress, affecting all versions up to 3.9.1. Authenticated users with subscriber-level permissions can exploit the bogo_rest_create_post_translation REST endpoint to duplicate posts written in non-default locales. This duplication process returns raw fields such as title.raw, content.raw, and excerpt.raw of private, draft, or password-protected posts, exposing sensitive information. The vulnerability leverages the fact that the translation endpoint enforces locale-based permission checks but does not properly restrict access based on user roles, allowing subscribers to bypass intended content restrictions. Contributors and higher roles can read the duplicated content, making the impact more significant at those privilege levels.

The vulnerability allows unauthorized disclosure of sensitive post content including titles, full content, excerpts, and passwords of private, draft, or password-protected posts. This exposure can lead to leakage of confidential or unpublished information to users who should not have access, potentially violating privacy or confidentiality requirements. The impact is limited to authenticated users with subscriber-level access or higher, and primarily affects posts in non-default locales.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict subscriber-level user permissions where possible and monitor for suspicious use of the bogo_rest_create_post_translation endpoint. Review and limit the number of users with contributor or higher roles to reduce risk. Follow updates from the vendor for an official fix.