Medium severity5.4NVD Advisory· Published Feb 1, 2025· Updated Jun 17, 2026
CVE-2024-12825
CVE-2024-12825
Description
The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search posts and link/unlink relations.
Affected products
3cpe:2.3:a:brechtvds:custom_related_posts:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:brechtvds:custom_related_posts:*:*:*:*:*:wordpress:*:*range: <1.7.4
- (no CPE)range: 0
- Range: <=1.7.3
Patches
Vulnerability mechanics
References
2- plugins.trac.wordpress.org/changesetnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/40ba98a0-2193-4201-8370-34fd438dadb3nvdThird Party Advisory
News mentions
0No linked articles in our index yet.