CVE-2026-92548 describes a sensitive information exposure vulnerability in the WP Popular Posts plugin for WordPress versions up to and including 7.4.2. The flaw arises because the plugin registers a REST API route with a permission callback that always returns true, allowing unauthenticated access. The 'context' parameter supplied by the caller is passed directly to WP_REST_Posts_Controller::prepare_item_for_response() without permission checks, enabling extraction of sensitive edit-context fields from non-public post types such as wp_block synced patterns. Additionally, the underlying query accepts arbitrary post_type values without enforcing public or show_in_rest visibility flags, further broadening the exposure.

An unauthenticated attacker can retrieve sensitive information from non-public WordPress post objects, including raw titles, content bodies, passwords, metadata, status, and GUIDs. This exposure could lead to information disclosure that WordPress core itself prevents for unauthenticated users. However, there is no indication of integrity or availability impact, and no known exploits are reported in the wild.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting access to the REST API endpoints or disabling the WP Popular Posts plugin may reduce exposure. Applying strict access controls on the WordPress REST API and limiting unauthenticated access to sensitive endpoints is recommended.