Loops & Logic CVE-2026-95604

Exploitation requires only that a target WordPress site have the Tangible Loops & Logic plugin installed and active at version 4.2.4 or earlier; the flaw is reachable by an unauthenticated remote attacker against default configurations (AV:N/AC:L/PR:N/UI:N). The limiting factors are product-specific rather than configuration-specific: the site must run this particular plugin (a niche, developer-oriented plugin, so real-world exposure is bounded), and impact is confined to unauthorized reading of data (C:H, I:N, A:N) - no write, modification, or availability impact is possible. The precise vulnerable endpoint/feature and the sensitivity of the exposed data are not specified in the available description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) describes a remotely reachable, network-based flaw requiring no authentication, no privileges, and no user interaction - an easy-to-reach precondition profile. However, impact is confidentiality-only (C:H, I:N, A:N): this is a data-exposure/information-disclosure issue via missing authorization (CWE-862), NOT code execution or takeover. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so there is no signal (SSVC exploitation status, automatable, or technical impact framework was not provided) of active or imminent exploitation. The result is a genuinely low-friction-to-exploit but bounded-impact vulnerability: prioritize patching because unauthenticated access to sensitive data is realistic and cheap for an attacker, but the absence of exploitation evidence and the confidentiality-only ceiling place it below RCE/account-takeover-class issues. The exact protected resource being exposed is not detailed in the description, so the real-world sensitivity of the leaked data cannot be confirmed from available data and should be verified against the Patchstack advisory.

An unauthenticated remote attacker sends a crafted request to a Loops & Logic endpoint (version <= 4.2.4) that fails to enforce an authorization check, returning data the requester should not be permitted to read. Because no authentication, privileges, or user interaction are required, the request can be issued directly against any exposed WordPress site running the plugin. No public exploit code was identified in the provided intelligence.