[CVE-2026-16960] The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to…

Descripción técnica

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

Puntuación CVSS

Score: 7.5/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Debilidades (CWE)

CWE-200

Fuente oficial

Publicado en NIST NVD.