What the vulnerability does
01Description
The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled.
Explanation of Vulnerability in Simple Terms
02Summary
LottieFiles versions 3.0.0 and earlier expose sensitive information that can be accessed over the network without authentication. An attacker can retrieve this data directly without needing to interact with a user or possess special privileges. The exposure is limited to confidentiality; the vulnerability does not allow modification or disruption of service.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the application without authentication.
Potential impact on your site
04Site Impact
Sensitive data may be exposed to unauthorized parties if LottieFiles is deployed in a production environment.
Conditions required to exploit
05Prerequisites
Network access to the affected LottieFiles instance; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 14, 2026
CVE published
April 8, 2026
Record updated
