Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U L N N 3.7 .0028 18.6 —
AFFECTED Product Versions Fixed My Private Site unspecified —
TIMELINE Aug 26 Reserved by WPScan Sep 5 Published (CNA: WPScan) Sep 6 EXPLOIT PUBLISHED — CVE-2026-81348 (Unknown My Private Site). Public exploit reference added.
The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.
| Date | Event | Detail |
|---|---|---|
| August 26, 2026 | Reserved | Reserved by WPScan |
| September 5, 2026 | Published | Published (CNA: WPScan) |
| September 6, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-81348 (Unknown My Private Site). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | My Private Site | — | — | — |
Authoritative record: CVE-2026-81348 at cve.org
Weaknesses: CWE-200
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-81348 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
