CubeWP All-in-One Dynamic Content Framework Information Exposure Vulnerability

A vulnerability allowing information exposure has been identified in the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress, affecting all versions through 1.1.27. The issue arises in the search feature of 'class-cubewp-search-ajax-hooks.php', where inadequate restrictions allow unauthenticated attackers to access and extract data from password-protected, private, or draft posts that should otherwise be inaccessible.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive post data, including information from password-protected, private, or draft posts.

Remediation

Users are advised to update the CubeWP – All-in-One Dynamic Content Framework plugin to version 1.1.28 or a newer patched version.