EUVD-2026-38681
GHSA-wqmq-jxx2-fmqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
AV:N because block editor is web-accessible; PR:L because contributor-level WordPress authentication is required; C:L because only scoped third-party service tokens are exposed, not broader system data.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24_block_enqueue_scripts() function being hooked to enqueue_block_editor_assets and, for any non-administrator user, falling back to loading the administrator-configured site-wide 24liveblog integration secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) from the options table via get_option() and emitting them through wp_localize_script() as the lb24BlockData JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract third-party 24liveblog account credentials (including the API token and refresh token) by simply opening the block editor and inspecting the page source.
AnalysisAI
Authenticated information disclosure in the 24liveblog WordPress plugin (versions ≤ 2.2) exposes third-party API credentials - including OAuth access tokens, refresh tokens, account UIDs, and usernames - to any contributor-level WordPress user who opens the block editor. The plugin's lb24_block_enqueue_scripts() function, hooked to enqueue_block_editor_assets, retrieves administrator-configured integration secrets from the WordPress options table and renders them into the page as a JavaScript global object (lb24BlockData) for all non-administrator users, where they are readable via basic browser source inspection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, but exploitation is trivially simple for any user holding a WordPress contributor account.
Technical ContextAI
The vulnerable code path lives in the WordPress Gutenberg block editor integration for the 24liveblog live blogging service. WordPress fires the enqueue_block_editor_assets action whenever a user opens the block editor, and the plugin registers lb24_block_enqueue_scripts() as a callback on that hook (visible at plugins.trac.wordpress.org/browser/24liveblog/trunk/src/init.php#L139 and #L157). For non-administrator users, the function falls back to retrieving the site-wide integration secrets - lb24_token, lb24_refresh_token, lb24_uid, and lb24_uname - directly from the WordPress options table via get_option() and injects them into the frontend JavaScript runtime using wp_localize_script(), binding them to the global lb24BlockData object. This is a textbook CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) pattern: server-side secrets with elevated access semantics are serialized into client-side HTML/JS without access control gating. The affected product identifier is CPE cpe:2.3:a:24liveblog:24liveblog_-_live_blog_tool:*:*:*:*:*:*:*:*, covering all versions up to and including 2.2.
RemediationAI
No vendor-released patched version has been independently confirmed in the available intelligence data. Site administrators should check the WordPress plugin repository for a version of 24liveblog above 2.2 and upgrade immediately if one exists. As an immediate compensating control, administrators should rotate the 24liveblog API token and refresh token via the 24liveblog service dashboard if any contributor-level or higher users - trusted or untrusted - have had block editor access on the affected site, since previously exposed tokens cannot be selectively invalidated. A second compensating control is to restrict block editor access for the Contributor role using a capability management plugin (such as Members or User Role Editor) by removing the edit_posts capability from Contributors; this prevents credential exposure but also prevents contributors from drafting posts, so the trade-off must be weighed against editorial workflow needs. If the live blog integration is not actively required, deactivating the plugin eliminates exposure entirely with no workflow impact. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaccdb3-4d98-4463-9db9-a6f1712d6869 should be monitored for patch release confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today