What is the CVSS score of EUVD-2026-38681?

EUVD-2026-38681 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

24liveblog WordPress Plugin EUVD-2026-38681

| CVE-2026-9183 MEDIUM

Information Exposure (CWE-200)

2026-06-24 Wordfence

GHSA-wqmq-jxx2-fmqp

WordPress Information Disclosure Wordpress Plugin 24Liveblog Live Blog Tool

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

AV:N because block editor is web-accessible; PR:L because contributor-level WordPress authentication is required; C:L because only scoped third-party service tokens are exposed, not broader system data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:59 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 4.3

DescriptionCVE.org

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24_block_enqueue_scripts() function being hooked to enqueue_block_editor_assets and, for any non-administrator user, falling back to loading the administrator-configured site-wide 24liveblog integration secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) from the options table via get_option() and emitting them through wp_localize_script() as the lb24BlockData JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract third-party 24liveblog account credentials (including the API token and refresh token) by simply opening the block editor and inspecting the page source.

AnalysisAI

Authenticated information disclosure in the 24liveblog WordPress plugin (versions ≤ 2.2) exposes third-party API credentials - including OAuth access tokens, refresh tokens, account UIDs, and usernames - to any contributor-level WordPress user who opens the block editor. The plugin's lb24_block_enqueue_scripts() function, hooked to enqueue_block_editor_assets, retrieves administrator-configured integration secrets from the WordPress options table and renders them into the page as a JavaScript global object (lb24BlockData) for all non-administrator users, where they are readable via basic browser source inspection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, but exploitation is trivially simple for any user holding a WordPress contributor account.

Technical ContextAI

The vulnerable code path lives in the WordPress Gutenberg block editor integration for the 24liveblog live blogging service. WordPress fires the enqueue_block_editor_assets action whenever a user opens the block editor, and the plugin registers lb24_block_enqueue_scripts() as a callback on that hook (visible at plugins.trac.wordpress.org/browser/24liveblog/trunk/src/init.php#L139 and #L157). For non-administrator users, the function falls back to retrieving the site-wide integration secrets - lb24_token, lb24_refresh_token, lb24_uid, and lb24_uname - directly from the WordPress options table via get_option() and injects them into the frontend JavaScript runtime using wp_localize_script(), binding them to the global lb24BlockData object. This is a textbook CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) pattern: server-side secrets with elevated access semantics are serialized into client-side HTML/JS without access control gating. The affected product identifier is CPE cpe:2.3:a:24liveblog:24liveblog_-_live_blog_tool:*:*:*:*:*:*:*:*, covering all versions up to and including 2.2.

RemediationAI

No vendor-released patched version has been independently confirmed in the available intelligence data. Site administrators should check the WordPress plugin repository for a version of 24liveblog above 2.2 and upgrade immediately if one exists. As an immediate compensating control, administrators should rotate the 24liveblog API token and refresh token via the 24liveblog service dashboard if any contributor-level or higher users - trusted or untrusted - have had block editor access on the affected site, since previously exposed tokens cannot be selectively invalidated. A second compensating control is to restrict block editor access for the Contributor role using a capability management plugin (such as Members or User Role Editor) by removing the edit_posts capability from Contributors; this prevents credential exposure but also prevents contributors from drafting posts, so the trade-off must be weighed against editorial workflow needs. If the live blog integration is not actively required, deactivating the plugin eliminates exposure entirely with no workflow impact. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaccdb3-4d98-4463-9db9-a6f1712d6869 should be monitored for patch release confirmation.