CVE-2025-69132 MEDIUM

CVE-2025-69132: WordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerability

Vendor Zozothemes
Product Corpkit
Weakness CWE-201
Published July 2, 2026
Last update July 2, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Corpkit versions up to 1.0.5 expose sensitive information to authenticated users. An attacker with low-level account access can read data they should not have permission to view. The vulnerability does not allow modification or deletion of data, only unauthorized disclosure. Update to a version newer than 1.0.5.

What an attacker can do

03Attacker Capabilities

Read sensitive data they should not have access to.

Potential impact on your site

04Site Impact

User data or configuration details may be exposed to low-privilege account holders.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site.

Key dates

06Disclosure timeline

July 2, 2026 CVE published
July 2, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5483 Odh-dashboard: odh dashboard kubernetes service account exposure CVE-2026-39480 WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability CVE-2026-40789 WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability CVE-2026-39542 WordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerability CVE-2026-10101 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users