CVE-2026-5336: Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/dataverse-integrationto a version that resolves this vulnerability.Fixed in 2.91 - Compensating control
Restrict access to the WordPress DataPress (Dataverse Integration) plugin’s server-side template rendering feature so that roles as low as Contributor cannot access it (until upgraded to a version >= 2.91).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5336?
The severity of CVE-2026-5336 is rated as medium with a score of 6.8.
What is CVE-2026-5336?
CVE-2026-5336 is a contributor-level server-side template injection vulnerability in the DataPress WordPress plugin, allowing for potential information disclosure.
How do I fix CVE-2026-5336?
To fix CVE-2026-5336, update the DataPress (Dataverse Integration) plugin to version 2.91 or later.
What are the potential impacts of CVE-2026-5336?
The potential impacts of CVE-2026-5336 include sensitive information disclosure, such as session cookies of higher privilege users.
Who is affected by CVE-2026-5336?
Users with a Contributor role in WordPress using the affected versions of the DataPress (Dataverse Integration) plugin are at risk from CVE-2026-5336.