EUVD-2026-85193
GHSA-c9c7-pp8h-rm54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running MPCX Lightbox
-
ExploitEnumerate target post IDs
-
ExecutionSend crafted unauthenticated AJAX request
-
ImpactRetrieve protected post title/content/excerpt
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target WordPress site to have MPCX Lightbox plugin versions 1.2.2 through 1.2.5 installed and active, and to contain non-public posts (private, draft, pending, trashed, or password-protected) worth retrieving. Exploitation is remote and unauthenticated with no user interaction (AV:N/PR:N/UI:N) against the default plugin configuration - the vulnerable AJAX action is exposed to unauthenticated users by the nature of the flaw. The practical limiting factor is not access difficulty but data value: sites with no sensitive unpublished content leak little, and impact is confined to reading post title/content/excerpt (no write or takeover). |
| Impact | This is a low-severity information-disclosure flaw (WPScan CVSS 3.1 base 3.7) in the MPCX Lightbox WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N confirms remote, unauthenticated (PR:N), no-interaction exploitation but limited confidentiality-only impact (C:L; I:N/A:N). A public exploit exists (WPScan), which distinguishes it from a purely theoretical issue, but there is no CISA KEV listing and no EPSS score in the provided data, so this is publicly available exploit code - not confirmed active exploitation, and the two must not be conflated. The AC:H metric assigned by WPScan is debatable: enumerating WordPress post IDs and issuing the vulnerable unauthenticated AJAX request is mechanically trivial (arguing for AC:L), so the practical barrier is lower than the score implies; the real limiter is whether a given site actually stores sensitive private/draft/password-protected posts worth harvesting. Overall this is a genuine but low-priority bug: real data leakage (private, draft, pending, trashed and password-protected post title/content/excerpt) with no integrity or availability impact, in a low-footprint plugin. Patch it, but absent evidence of targeting it does not warrant emergency response. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates post IDs against a target WordPress site and sends crafted requests to the vulnerable MPCX Lightbox AJAX action, which returns the title, content or excerpt without checking authorization or post status. This exposes private, draft, pending, trashed and password-protected posts. A public exploit is available via WPScan, and no user interaction or authentication is required (AV:N/PR:N/UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated information disclosure in the MPCX Lightbox WordPress plugin (versions 1.2.2 through 1.2.5) lets any remote visitor call an AJAX action that exposes the title, content, or excerpt of posts they should not be able to read, including private, draft, pending, trashed, and password-protected entries. The flaw carries no authentication or privilege requirement and no user interaction is needed, and WPScan has published a proof-of-concept reference, so publicly available exploit code exists; the vendor has rated the issue as low severity (CVSS 3.1 base 3.7, AC:H), while our assessment scores it 3.1 with AC:L because exploiting the exposed action requires only a direct request to the site's admin-ajax.php endpoint, not special timing or conditions. Practical risk is bounded by data value rather than access difficulty: sites without sensitive unpublished content leak little, and impact is limited to reading post data with no write, privilege escalation, or site takeover.
RemediationAI
No patched version is identified in the available intelligence, so patch status should be confirmed with the plugin maintainer or through the WPScan entry at https://wpscan.com/vulnerability/183ec34f-446f-481f-9019-26e005ad2cfb/ before relying on an upgrade as a fix. Until a fixed release is confirmed, the most direct control is to deactivate and, if it is not business-critical, remove the MPCX Lightbox plugin - the trade-off is loss of the lightbox functionality, which is usually acceptable for an informational-disclosure exposure. If the plugin must remain active, block the vulnerable AJAX action at the edge: inspect POST/GET requests to /wp-admin/admin-ajax.php containing the plugin's action parameter and return 403 for unauthenticated callers, or restrict admin-ajax.php to authenticated sessions where the front end does not depend on anonymous AJAX - the trade-off is that a blanket block or restriction will break other plugins and themes that legitimately use admin-ajax.php for anonymous users, so the rule should be scoped to the specific action rather than the whole endpoint. As data-side mitigation, move sensitive drafts, pending, private, and password-protected posts out of the WordPress database or into an unpublished staging environment, and review password-protected posts on the assumption that titles, content, and excerpts may already have been exposed; note that this reduces the value of the target but does not close the endpoint. Finally, enable and review web server and WordPress access logs for unauthenticated requests to admin-ajax.php carrying the plugin's action parameter to detect reconnaissance or historical exploitation, and treat any such hits as evidence that the content of unpublished posts may have been harvested.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MPCX Lightbox is a WordPress plugin that registers AJAX handlers served through WordPress's admin-ajax.php dispatcher. AJAX actions intended for logged-in users are normally hooked with wp_ajax_<action> plus a capability check (current_user_can) and a nonce check, while actions exposed to anonymous visitors use wp_ajax_nopriv_<action> and must enforce their own authorization. In versions 1.2.2 through 1.2.5, one of these actions is reachable by unauthenticated users and performs neither an authorization check nor a nonce verification, and it further fails to validate the status of the post identified in the request. Because WordPress post retrieval functions such as get_post(), get_the_excerpt(), and content filters do not themselves enforce visibility for callers that bypass the normal template hierarchy, the handler returns data for any post ID supplied - including private, draft, pending, trashed, and password-protected posts. This is a classic broken-access-control / missing-authorization weakness in an AJAX endpoint (CWE-862-class) leading to exposure of sensitive information (CWE-200-class), and it exists purely on the server side with no client-side component, so WAF and log inspection of admin-ajax.php requests with the plugin's action parameter can detect probing. The CPE record (cpe:2.3:a:unknown:mpcx_lightbox:*:*:*:*:*:*:*:*) reflects that the plugin's vendor identifier is not normalized in NVD, so coverage based on CPE matching alone may be unreliable; version detection should be confirmed directly on the WordPress installation.
Know when Mpcx Lightbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated AJAX access with trivial post-ID enumeration warrants AC:L (I diverge from WPScan's AC:H); impact is confidentiality-only leakage of post content, so C:L and I:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
DescriptionCVE.org
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB