All Bootstrap Blocks CVE-2026-62036

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) on a site running the All Bootstrap Blocks plugin version 1.3.31 or earlier; the target must expose the vulnerable plugin functionality. No user interaction is required (UI:N) and no special non-default configuration is indicated in the description. The low-privilege authentication requirement is the primary limiting factor - anonymous/unauthenticated visitors cannot exploit this - which substantially narrows the realistic attacker population to users who can register or have been granted an account. Impact is confined to disclosure of embedded sensitive data with no write or availability effect.

This is a low-to-moderate severity information disclosure flaw (CVSS 4.3) in the All Bootstrap Blocks WordPress plugin. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network-reachable, low-complexity exploitation but requires PR:L - an authenticated attacker holding at least low-level privileges (e.g., a subscriber or contributor account). Impact is limited to a partial confidentiality breach (C:L) with no integrity or availability impact, consistent with CWE-497 (Exposure of Sensitive System Information). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable near-term exploitation. The signals are internally consistent: the authentication requirement, the limited confidentiality-only impact, and the absence of exploitation intelligence all point to a genuine but low-priority issue rather than an urgent threat. This should be patched in the normal maintenance cycle and is not a high-real-risk item despite being network-accessible; the PR:L requirement meaningfully constrains who can exploit it.

An attacker who has obtained a low-privilege authenticated account on a WordPress site running All Bootstrap Blocks (<= 1.3.31) sends a crafted request to a plugin endpoint and retrieves embedded sensitive system or configuration data they should not be able to see. No public exploit code was identified in the provided data, and no user interaction is required.