CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Explanation of Vulnerability in Simple Terms
CubeWP Framework versions up to 1.1.27 expose sensitive information to unauthenticated attackers over the network. The vulnerability requires no user interaction and can be exploited remotely without authentication. An attacker can read non-public data from the framework, though integrity and availability are not affected.
What an attacker can do
Read sensitive information from the CubeWP Framework without authentication.
Potential impact on your site
Confidential data may be exposed to anyone on the internet who knows how to request it.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
