What the vulnerability does
01Description
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
Explanation of Vulnerability in Simple Terms
02Summary
CubeWP Framework versions up to 1.1.30 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can craft requests to access files outside the intended directory, potentially exposing sensitive configuration files, database credentials, or other confidential data. No user interaction is required.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including sensitive configuration and credential files.
Potential impact on your site
04Site Impact
Attackers can access sensitive files like wp-config.php, database backups, or private keys without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 1, 2026
CVE published
