CVE-2026-120520
Deferred Deferred - Pending Action

Sensitive Information Exposure in Greenshift WordPress Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references in {{GET:key}})' parameter. This makes it possible for unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim's browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker's crafted link — neither condition is part of the plugin's default state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-120520
EUVD
EUVD-2026-118555

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpsoul Greenshift – animation and page builder blocks From 0 (inc) to 13.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Greenshift WordPress plugin allows unauthenticated attackers to steal authenticated users' WordPress session cookies via a crafted link. The issue occurs when a site uses a Greenshift image block with a {{GET:}} placeholder in the src attribute. Attackers can inject a nested {{COOKIE:}} placeholder to force the victim's browser to send their HttpOnly session cookie to an attacker-controlled server as an image URL.

Detection Guidance

Check WordPress sites using Greenshift plugin versions up to 13.2.2 for public image blocks with {{GET:}} placeholders in src attributes. Inspect server logs for suspicious image src URLs containing {{COOKIE:}} placeholders or external domains.

Impact Analysis

If you are a WordPress site user or administrator, this vulnerability could allow attackers to hijack your authenticated session. This means they could impersonate you, access your account, and perform actions on your behalf without needing your password. For site owners, it risks unauthorized access to the WordPress dashboard and sensitive site data.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR (if personal data is exposed) and HIPAA (if protected health information is compromised). Organizations may face legal penalties, reputational damage, and increased scrutiny for failing to protect sensitive user data.

Mitigation Strategies

Update Greenshift plugin to the latest version beyond 13.2.2. Remove any public image blocks using {{GET:}} placeholders. Review and restrict access to server logs containing sensitive session data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120520. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...