What is the CVSS score of CVE-2026-116613?

CVE-2026-116613 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-116613?

Within 24 hours, inventory all WordPress installations running Animated Text Block up to and including 1.2.6 and audit Contributor-level accounts for legitimacy and least privilege; remove or downgrade any accounts that do not require content-authoring rights. Within 7 days, if the plugin is not essential, deactivate and remove it entirely; if required, restrict Contributor role capabilities and monitor/review site logs for shortcode-based access to non-public custom post types, and consider a WAF rule blocking manipulated 'animated-text' shortcode post-ID requests. Within 30 days, engage the plugin maintainer or vendor for a fix timeline, evaluate alternative plugins that render animated text without exposing arbitrary post content, and re-verify no Contributor accounts retain unnecessary access until a patched version above 1.2.6 is released and deployed.

Animated Text Block CVE-2026-116613

EUVD-2026-111575 HIGH

Missing Authorization (CWE-862)

2026-10-28 Wordfence

GHSA-fr3x-9wrh-9rp5

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Bplugins Animated Text Block Add Typing And Looping Text Effects

7.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as Contributor-level user
Exploit

Insert 'animated-text' shortcode with arbitrary target post ID
Execution

Plugin fetches post and calls displayContent() without capability or post-type check
Impact

Read rendered content of hidden/non-public post

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated account with Contributor-level capability or higher on a WordPress site running Animated Text Block ≤1.2.6, plus the ability to place the 'animated-text' shortcode (which Contributors can do within their own posts). The attacker supplies an arbitrary target post ID; exploitation succeeds only against posts in the 'publish' status, and discloses the rendered content of posts that are normally hidden - including non-public custom post types with public=false and show_in_rest=false. Limiting factors: no anonymous/unauthenticated path (despite the CVSS PR:N), read-only confidentiality impact (no modification or DoS), and the target post must be published; drafts/private posts are not indicated as reachable by the described branch.
Impact	This is a broken-access-control / missing-authorization flaw (CWE-862) in the Animated Text Block WordPress plugin, scored CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact, no integrity or availability effect. A significant conflict exists between the CVSS vector and the description: the vector encodes PR:N (unauthenticated), yet the description explicitly states exploitation requires 'authenticated attackers, with Contributor-level access and above.' The PR:N rating therefore overstates reach; realistically this requires an authenticated low-privilege account, which I reflect in my independent assessment as PR:L (base ~6.5). On the exploitation signals: KEV status is not present in the input, so there is no public exploit identified at time of analysis; no EPSS score was supplied; and the provided references are the Wordfence advisory plus plugin.trac source-code lines (the vulnerable atb_shortcode_handler()/displayContent() path), not a weaponized proof-of-concept. SSVC-style framing: the vuln.today Decision label is 'this_week' (not act_now/emergency), technical impact is partial (read-only disclosure), and automatability is limited because an attacker must already hold a Contributor account on the target site. Net: this is a legitimate but moderate-priority information-disclosure issue - the inflated CVSS 7.5 driven by PR:N overstates the real-world urgency, which is bounded by the authenticated-Contributor prerequisite and the confidentiality-only impact.
Exploit ScenarioDerived	On a multi-author WordPress site running Animated Text Block ≤1.2.6, a user with Contributor-level access inserts the 'animated-text' shortcode supplying an arbitrary post ID that points to a non-public custom post type (public=false, show_in_rest=false). Because atb_shortcode_handler() fetches the post and calls displayContent() in the 'publish' branch with no capability check and no is_post_type_viewable() validation, the hidden post's rendered content is returned to the attacker, bypassing the protections WordPress normally applies to direct URLs and the REST API. No public exploit code is identified; the referenced links are the vendor advisory and plugin source, not a verified PoC.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 28, 2026

Information disclosure in the Animated Text Block WordPress plugin (versions up to and including 1.2.6) allows an authenticated user with Contributor-level access or higher to read the rendered content of any published post on the site. The 'animated-text' shortcode handler accepts an attacker-supplied post ID and, in its 'publish' branch, renders the post without any capability check and without verifying that the post type is the plugin's own custom post type or is otherwise viewable - so posts in non-public custom post types (public=false, show_in_rest=false) that WordPress normally hides from direct URLs and the REST API can be disclosed. Impact is confidentiality-only (no modification or denial of service), the target post must be in 'publish' status, and no public exploit code or PoC reference is present in the available sources; the vuln.today decision label is this_week.

RemediationAI

Apply the vendor fix referenced by the plugin changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3767751%40animated-text-block&new=3767751%40animated-text-block - the data does not state the tagged release version that ships it, so confirm on the plugin's WordPress.org page that the installed version is newer than 1.2.6 and contains changeset r3767751 before considering the site fixed; no vendor-released patch version is confirmed at time of analysis. The changeset is the only complete fix, since the missing capability and is_post_type_viewable() checks live in the shortcode handler itself. Until an updated release is confirmed, exposure can be reduced by auditing and restricting Contributor-and-above accounts and reviewing existing Contributor-authored posts for embedded 'animated-text' shortcodes, since the handler can only be reached by an account that can place shortcode content - the trade-off is that this breaks the normal editorial workflow for that role. Deactivating or removing the plugin eliminates the vulnerable handler entirely, at the cost of losing all animated text blocks already rendered on the site. Blocking REST or front-end access alone does not help, because the disclosure occurs through normal shortcode rendering rather than through a request to the target post's own URL.

Affected VersionsENISA

Animated Text Block – Add Typing and Looping Text Effects 0 ≤1.2.6

Affected Packages

euvd animated_text_block_add_typing_and_looping_text_effects no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The plugin registers a shortcode, 'animated-text', whose handler atb_shortcode_handler() (plugin.php lines ~132, ~142 and ~163 in the 1.2.6 tag) resolves a post from an ID supplied inside the shortcode attributes and then, when that post's status is 'publish', calls displayContent() to output its rendered block content. The root cause is CWE-862 (Missing Authorization): there is no current_user_can() gate on the branch and no check that the resolved object's post_type belongs to the plugin or passes is_post_type_viewable(), so the shortcode becomes a generic read primitive over published content regardless of the post type's public/show_in_rest flags. Because Contributors can author posts and embed shortcodes in their own content, they can trigger the handler repeatedly with different IDs. Note the scoring discrepancy: the published CVSS 3.1 vector carries PR:N, while this assessment scores PR:L, because a Contributor-or-higher account is required to place and render the shortcode; AV:N/AC:L/UI:N and the confidentiality-only C:H/I:N/A:N impact are consistent across both. The trigger path requires an authenticated editor placing the shortcode - it is not reachable anonymously.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY HIGH

NVD 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 6.5 MEDIUM

Description requires Contributor-level authentication so PR:L (not PR:N); network shortcode trigger with no user interaction, confidentiality-only disclosure, so C:H/I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionNVD

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch, calling displayContent() with no capability check and no validation that the post's post_type is the plugin's own CPT or is otherwise viewable (is_post_type_viewable()). This makes it possible for authenticated attackers, with Contributor-level access and above, to read the rendered block content of any published post, including posts of non-public custom post types (public=false, show_in_rest=false) that WordPress would otherwise hide from direct URLs and the REST API.

Executive ViewAI

Why It Matters

CVE-2026-116613 affects the Animated Text Block WordPress plugin (up to v1.2.6), allowing low-privilege Contributor-level users to read content from published posts that WordPress normally keeps hidden - including non-public custom post types. Because many organizations grant Contributor access to broad or external user populations, this creates an insider-style confidentiality exposure for sensitive internal content. No public exploit has been identified, and the plugin has no vendor patch available at time of analysis.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: remove or tighten Contributor-level accounts, deactivate the plugin if not business-critical, audit for sensitive content in non-public custom post types, and deploy WAF/log monitoring to detect shortcode-based access to hidden posts.

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Prevalence

Low

niche single-purpose WordPress text-effect plugin, limited install base

Data Quality

3 sources

Confidence: Low

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.