Cubewp
Monthly
SQL injection in the CubeWP WordPress framework plugin versions 1.1.30 and earlier grants any authenticated subscriber the ability to execute arbitrary SQL against the underlying WordPress database, with a CVSS-confirmed scope change that extends impact beyond the plugin itself to the full database layer. Exploitation requires only the lowest WordPress authenticated role - subscriber - combined with network access and no user interaction, meaning any registered site user is a potential threat actor. No active exploitation via CISA KEV and no public POC have been identified at time of analysis, but the low privilege entry bar and high confidentiality impact make this a meaningful risk for sites with open user registration.
CubeWP - All-in-One Dynamic Content Framework plugin for WordPress versions up to 1.1.23 contains a privilege escalation vulnerability that allows authenticated attackers with Subscriber-level access to elevate their privileges to administrator through arbitrary user meta manipulation. The vulnerability exploits improper access controls on the update_user_meta() function, enabling account takeover and full site compromise. No active exploitation in the wild has been confirmed at this time, but the low attack complexity and high impact make this a critical remediation priority.
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.1.15. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP - All-in-One Dynamic Content Framework.1.12. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in the CubeWP WordPress framework plugin versions 1.1.30 and earlier grants any authenticated subscriber the ability to execute arbitrary SQL against the underlying WordPress database, with a CVSS-confirmed scope change that extends impact beyond the plugin itself to the full database layer. Exploitation requires only the lowest WordPress authenticated role - subscriber - combined with network access and no user interaction, meaning any registered site user is a potential threat actor. No active exploitation via CISA KEV and no public POC have been identified at time of analysis, but the low privilege entry bar and high confidentiality impact make this a meaningful risk for sites with open user registration.
CubeWP - All-in-One Dynamic Content Framework plugin for WordPress versions up to 1.1.23 contains a privilege escalation vulnerability that allows authenticated attackers with Subscriber-level access to elevate their privileges to administrator through arbitrary user meta manipulation. The vulnerability exploits improper access controls on the update_user_meta() function, enabling account takeover and full site compromise. No active exploitation in the wild has been confirmed at this time, but the low attack complexity and high impact make this a critical remediation priority.
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Exploiting Incorrectly Configured Access Control Security Levels.1.15. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP - All-in-One Dynamic Content Framework.1.12. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.