CubeWP All-in-One Dynamic Content Framework Information Exposure Vulnerability

A vulnerability allowing information exposure exists in the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress, in all versions through 1.1.27. The issue arises in the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints, where insufficient restrictions allow unauthenticated attackers to access data from password-protected, private, or draft posts that should be off-limits.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information from restricted posts, including password-protected, private, or draft content.

Remediation

Users are advised to update the CubeWP – All-in-One Dynamic Content Framework plugin to version 1.1.28 or a newer patched version.