Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt, and password of any private, draft, or password-protected post by triggering its duplication via the translation endpoint and reading the returned title.raw, content.raw, and excerpt.raw fields of the duplicated post. This vulnerability is exploitable against posts written in a non-default locale, as authenticated subscribers can request a translation into the site's default locale to pass the locale-only permission gate. While subscribers can trigger the endpoint, this is only impactful at the Contributor-level as they can actually read the duplicated content.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rocklobsterinc | Bogo | up to 3.9.1 | — | No fix listed | CNA |
- Bogo Vendorrocklobsterinc Affected up to 3.9.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9013
- 2026-10-03 Alias added: GHSA-4vf9-6whq-7g9v
References
Other 9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b04ba117-da4b-445e-99c2-69a5e4f34a65?source=cve
- https://plugins.trac.wordpress.org/browser/bogo/tags/3.9.1/includes/rest-api.php#L202
- https://plugins.trac.wordpress.org/browser/bogo/tags/3.9.1/includes/rest-api.php#L31
- https://plugins.trac.wordpress.org/browser/bogo/tags/3.9.1/includes/post.php#L293
- https://plugins.trac.wordpress.org/browser/bogo/trunk/includes/rest-api.php#L202
- https://plugins.trac.wordpress.org/browser/bogo/trunk/includes/rest-api.php#L31
- https://plugins.trac.wordpress.org/browser/bogo/trunk/includes/post.php#L293
- https://github.com/rocklobster-in/bogo/pull/382/changes
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3574263%40bogo&new=3574263%40bogo&sfp_email=&sfph_mail=
More rocklobsterinc vulnerabilities
- TI-2020-18011 The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows… CVSS 3.1CRITICAL 10.0
- TI-2023-21407 WordPress Contact form 7 Custom validation Plugin <= 1.1.3 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-04377 Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect CVSS 3.1MEDIUM 6.1
- TI-2018-14941 The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of… CVSS 3.0CRITICAL 9.8
- TI-2021-06451 Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVSS 3.1HIGH 8.8
- TI-2023-05917 Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload CVSS 3.1HIGH 7.2
Sources
- CVE-2026-9013 · CVE Program
- CVE-2026-9013 · NVD
- FIRST EPSS
- GHSA-4vf9-6whq-7g9v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences