CVE-2025-68033 HIGH

CVE-2025-68033: WordPress Custom Related Posts plugin <= 1.8.0 - Sensitive Data Exposure vulnerability

Vendor Brecht
Product Custom Related Posts
Weakness CWE-201
Published January 5, 2026
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.This issue affects Custom Related Posts: from n/a through <= 1.8.0.

Explanation of Vulnerability in Simple Terms

02Summary

Custom Related Posts through version 1.8.0 exposes sensitive information that should not be publicly accessible. An attacker on the network can read this data without authentication or user interaction. The vulnerability affects the confidentiality of information stored or processed by the plugin, though data integrity and site availability are not impacted.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the plugin without authentication.

Potential impact on your site

04Site Impact

Sensitive data handled by Custom Related Posts may be exposed to unauthenticated visitors.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

January 5, 2026 CVE published
April 28, 2026 Record updated