CVE-2026-17018
Received Received - Intake

Unauthorized Metadata Exposure in CubeWP WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-17018
EUVD
EUVD-2026-55025

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cubewp cubewp_framework to 1.1.30 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the CubeWP Framework WordPress plugin versions 1.1.30 and below. It allows users with the Contributor role or higher to access arbitrary post metadata and user metadata without proper authorization checks. This includes sensitive data from drafts, private posts, and even administrator accounts.

Detection Guidance

Check WordPress REST API endpoints for unauthorized metadata access. Use tools like WPScan to test for the vulnerability: wpscan --url <target_url> --enumerate vp,vt. Monitor logs for unusual requests to /wp-json/cubewp/v1/ endpoints.

Impact Analysis

If you use the CubeWP Framework plugin, attackers with basic user roles could access private or sensitive data such as draft posts, user details, or administrator information. This could lead to data leaks, unauthorized access, or further exploitation of your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized disclosures, and failure to protect user privacy, potentially leading to legal penalties.

Mitigation Strategies

Disable the CubeWP Framework plugin immediately if installed. Restrict user roles to the minimum required permissions. Monitor for unauthorized access attempts. Apply updates if a patch becomes available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart