CVE-2026-4792: Bread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure
The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (downloadsettings function) which is registered on the pluginsloaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protectionpassword field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can request the exposed export endpoint. No WordPress account, administrative access, or user interaction is required.
What information is exposed?
The settings export includes all Bread plugin configuration settings, including the PDF protection password. The protection_password value is stored in plaintext.
How can I determine whether a site is affected?
Sites running Bread version 2.9.12 or earlier are affected. The vulnerable export functionality is reachable through the /?export-meeting-list=1 endpoint on public, non-admin pages.