EUVD-2026-55025
GHSA-8w3v-fgcp-f927
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Contributor is a low-privilege WordPress role (PR:L not PR:H); network-accessible REST API; read-only confidentiality impact only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
AnalysisAI
Broken object-level authorization in the CubeWP Framework WordPress plugin through version 1.1.30 exposes arbitrary post and user metadata via an unprotected REST API endpoint. Any authenticated user with the Contributor role or higher can request metadata from posts they do not own - including draft, pending, private, and password-protected content - as well as metadata belonging to any user account, including site administrators. A publicly available exploit has been disclosed by WPScan, though EPSS signals (0.13%, 3rd percentile) indicate real-world exploitation remains limited at time of analysis.
Technical ContextAI
The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the REST API endpoint accepts caller-supplied metadata key names and object identifiers without validating whether the requesting principal is authorized to read that specific object or key. WordPress natively provides post visibility and ownership controls, but the plugin bypasses these by not implementing per-object authorization checks on its custom endpoint. The affected product is identified in NVD CPE as cpe:2.3:a:unknown:cubewp_framework:*:*:*:*:*:*:*:* (vendor field unresolved), covering all versions up to and including 1.1.30. The plugin provides a framework layer for WordPress page/content builders, making its REST API surface accessible to any registered user on sites that allow contributor-level registration.
RemediationAI
Check whether a patched release beyond version 1.1.30 has been published by the CubeWP Framework plugin author via the WordPress plugin repository or the vendor's own channel; no confirmed fix version is available in the current data set (upstream fix status unconfirmed). If no patch is available, the most effective compensating control is to disable contributor-level or open user registration on the WordPress site via Settings > General > uncheck 'Anyone can register', which eliminates the low-privilege entry point. Additionally, restrict REST API access to authenticated sessions only by configuring a firewall rule or using a plugin such as Disable REST API to block unauthenticated and low-privilege REST calls to the affected endpoint path. As a further safeguard, audit stored user metadata for sensitive values (API keys, tokens) stored as WordPress usermeta and rotate any such credentials. Monitor the WPScan advisory at https://wpscan.com/vulnerability/df87c8d0-b3f3-4995-ac95-d63544e71a32/ for patch release notifications.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today