CVE-2026-9013: 
WordPress vulnerability analysis and mitigation

CVE-2026-9013 is a sensitive information exposure vulnerability in the Bogo plugin for WordPress, classified as Missing Authorization (CWE-862). It affects all versions of the plugin up to and including 3.9.1, allowing authenticated attackers with subscriber-level access or above to extract the raw title, content, excerpt, and password of private, draft, or password-protected posts via the bogo_rest_create_post_translation REST API endpoint. The vulnerability was disclosed on June 19, 2026, with a patch merged on May 29, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is insufficient authorization in the bogo_rest_create_post_translation REST API endpoint (includes/rest-api.php), classified as CWE-862 (Missing Authorization). The permission callback only checked whether the requesting user had access to the target locale (bogo_access_locale), but did not verify whether the user had the capability to read or edit the underlying post. An attacker exploiting this flaw targets posts written in a non-default locale and requests a translation into the site's default locale — a locale the subscriber is permitted to access — thereby bypassing the locale-only permission gate. The duplicated post's response included title.raw, content.raw, and excerpt.raw fields populated with the original post's sensitive data, regardless of the post's visibility status. The fix, merged in PR #382, adds checks for create_posts capability in the permission callback and gates raw field exposure on the edit_post capability for the duplicated post (GitHub PR, Wordfence).

Successful exploitation allows authenticated users — most impactfully at the Contributor level — to read the raw content, title, excerpt, and password of any private, draft, or password-protected post on the WordPress site, regardless of the post's intended access restrictions. This constitutes a confidentiality breach that could expose sensitive editorial content, unpublished drafts, or password-protected information to unauthorized parties. There is no integrity or availability impact, and the scope is limited to the affected WordPress instance (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Bogo plugin version 3.9.1 or earlier. This can be done by checking the plugin's readme.txt file at /wp-content/plugins/bogo/readme.txt or by observing locale-switching behavior on the site.
2. Obtain authenticated access: Register or log in as a subscriber-level (or higher) user on the target WordPress site.
3. Identify target posts: Determine the IDs of private, draft, or password-protected posts written in a non-default locale. Post IDs may be inferred from URL patterns, sitemaps, or other enumeration techniques.
4. Craft the malicious REST API request: Send an authenticated POST request to the Bogo translation endpoint, specifying the target post ID and requesting a translation into the site's default locale (which the subscriber is permitted to access):

   POST /wp-json/bogo/v1/post-translations
   { "id": <target_post_id>, "locale": "<default_locale>" }

5. Extract sensitive data: Parse the JSON response for the title.raw, content.raw, excerpt.raw, and post password fields of the duplicated post, which are returned without proper authorization checks in vulnerable versions (GitHub PR, Wordfence).

• Network: Authenticated REST API POST requests to /wp-json/bogo/v1/post-translations (or equivalent endpoint) from subscriber or contributor accounts, especially targeting post IDs that correspond to private, draft, or password-protected content.
• Logs: WordPress access logs showing repeated or unusual calls to the Bogo translation REST endpoint from low-privilege user accounts; requests targeting multiple post IDs in rapid succession may indicate enumeration.
• Logs: Authentication logs showing subscriber-level accounts making REST API calls outside of normal usage patterns for a translation plugin.
• Application: Unexpected draft or translated copies of private/password-protected posts appearing in the WordPress post list, created by low-privilege users (Wordfence).

The fix was merged into the Bogo plugin's master branch via PR #382 on May 29, 2026, and users should update to a version beyond 3.9.1 that includes this patch. The fix adds create_posts capability checks in the REST API permission callback and gates raw field exposure on the edit_post capability. As a workaround prior to patching, site administrators should restrict registration of subscriber/contributor accounts, or temporarily disable the Bogo plugin if translation functionality is not critical. Administrators should also audit REST API logs to determine if the bogo_rest_create_post_translation endpoint has been accessed by low-privilege users (GitHub PR, Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the week of June 15–21, 2026. The CVE status is marked as "Deferred" by NVD, indicating it is not being prioritized for NVD enrichment. No significant broader media coverage or notable researcher commentary beyond Wordfence's standard reporting has been observed (Wordfence Weekly Report).