Cubewp Framework
Monthly
Broken object-level authorization in the CubeWP Framework WordPress plugin through version 1.1.30 exposes arbitrary post and user metadata via an unprotected REST API endpoint. Any authenticated user with the Contributor role or higher can request metadata from posts they do not own - including draft, pending, private, and password-protected content - as well as metadata belonging to any user account, including site administrators. A publicly available exploit has been disclosed by WPScan, though EPSS signals (0.13%, 3rd percentile) indicate real-world exploitation remains limited at time of analysis.
Broken object-level authorization in the CubeWP Framework WordPress plugin through version 1.1.30 exposes arbitrary post and user metadata via an unprotected REST API endpoint. Any authenticated user with the Contributor role or higher can request metadata from posts they do not own - including draft, pending, private, and password-protected content - as well as metadata belonging to any user account, including site administrators. A publicly available exploit has been disclosed by WPScan, though EPSS signals (0.13%, 3rd percentile) indicate real-world exploitation remains limited at time of analysis.