Vimeo
Monthly
Sensitive subscriber data exposure in the Vimeo WordPress plugin (versions 1.2.2 and earlier) allows unauthenticated remote attackers to retrieve confidential subscriber information via network requests. Reported by Patchstack and tracked as EUVD-2026-53973, the flaw is rooted in CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin actively includes protected subscriber data in responses that should not be accessible without authorization. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Sensitive subscriber data exposure in the Vimeo WordPress plugin (versions 1.2.2 and earlier) allows unauthenticated remote attackers to retrieve confidential subscriber information via network requests. Reported by Patchstack and tracked as EUVD-2026-53973, the flaw is rooted in CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin actively includes protected subscriber data in responses that should not be accessible without authorization. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.