CVE-2026-17018: CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17018?
CVE-2026-17018 has a risk rating of 65, indicating a moderate severity level.
How do I fix CVE-2026-17018?
To fix CVE-2026-17018, update the CubeWP Framework plugin to version 1.1.31 or later.
Who is affected by CVE-2026-17018?
Users with the Contributor role and above in CubeWP Framework versions 1.1.30 and below are affected by CVE-2026-17018.
What type of vulnerability is CVE-2026-17018?
CVE-2026-17018 is an IDOR (Insecure Direct Object Reference) vulnerability that allows unauthorized access to post metadata.
What can attackers do with CVE-2026-17018?
Attackers can exploit CVE-2026-17018 to disclose arbitrary post and user metadata through API requests.