Private Post Share
Private Post Share has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for Private Post Share has a vendor fix available, so running the current release closes it.
All of these findings were reported by Pierre Rudloff. Private Post Share is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-5920Sharable Password Protected Posts <= 1.1.0 - Unauthenticated Password protected Post Exposure
Read the full analysisVulnerability Records
Private Post Share
Author
Fabian Todt
Share a link to anonymous users to view private and password protected posts (or any other public post type). This plugin generates secret URLs (similar to Google Docs and other cloud services) for posts so you can share them with not-logged in users without having to share an extra password with them. For bug reports, security vulnerabilities, feature requests please visit the GitHub repository. Usage To enable a sharable url check the box below the edit post box on a private or password protected post The link will be displayed if the checkbox is checked, just copy and share the link. To disable just uncheck the box. By default, it’s enabled for all public post types, but that can be changed via the private_post_share/post_types filter.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C