EUVD-2026-51921
GHSA-2cff-wc4f-2m48
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable AJAX endpoint, nonce trivially harvestable from public pages, no authentication needed, confidentiality-only impact as only file reads are possible.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
AnalysisAI
Directory traversal in the CubeWP Framework WordPress plugin (all versions through 1.1.30) enables unauthenticated attackers to read arbitrary files accessible to the web server process via the cubewp_get_svg_content AJAX handler. The nonce mechanism that gates this endpoint is rendered ineffective because the nonce is publicly emitted into page markup whenever the CubeWP posts shortcode or widget with AJAX loading is active, allowing any guest visitor to harvest it before submitting a malicious request. No public exploit or KEV listing has been identified at time of analysis, but the CVSS 7.5 rating reflects realistic unauthenticated, low-complexity exploitability with full confidentiality impact - targeting files such as wp-config.php containing database credentials and secret keys.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the cubewp_get_svg_content function, defined in cube/functions/admin-functions.php around line 1170, accepts a caller-supplied file path and returns file contents without adequately sanitizing or restricting path traversal sequences. WordPress AJAX endpoints are typically protected by nonce tokens to prevent unauthorized requests; however, because the plugin injects the nonce directly into page HTML for any visitor viewing a page with the CubeWP posts shortcode or widget with AJAX loading enabled, the nonce provides no meaningful access control. An attacker reads the nonce from the HTML, reuses it in a crafted POST to wp-admin/admin-ajax.php, and supplies a traversal payload to escape the intended SVG directory. CPE strings were not supplied in the input, but the affected software is the cubewp-framework plugin for WordPress, versions ≤ 1.1.30, as confirmed by the Wordfence advisory and the Trac changeset reference.
RemediationAI
Update the CubeWP Framework plugin to a version that incorporates changeset 3627738 (https://plugins.trac.wordpress.org/changeset/3627738/cubewp-framework); the exact patched release version number is not confirmed in the available input data and should be verified in the WordPress plugin repository changelog before deploying. If an immediate plugin update is not possible, the most effective compensating control is to disable or remove any pages, posts, or widgets that render the CubeWP posts shortcode or widget with AJAX loading enabled - this removes the publicly emitted nonce and eliminates the unauthenticated exploitation path. A WAF rule blocking path traversal sequences (../, encoded variants such as %2e%2e%2f, and absolute path prefixes) in AJAX POST bodies destined for wp-admin/admin-ajax.php with the CubeWP action parameter can reduce risk with minimal operational impact, though it should not be treated as a permanent substitute for patching. Consult the full Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=cve for additional guidance.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today