CVE-2026-87848: MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
Published Sep 23, 2026
·Updated
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.
Affected Software
1 affected component
MPCX MPCX Lightbox>=1.2.2<=1.2.5
Event History
Sep 23, 2026
CVE Published
via MITRE·10:11 AM
Data Sourced
via MITRE·10:11 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which content can an unauthenticated visitor retrieve?
An unauthenticated visitor can retrieve the title, content, or excerpt of arbitrary posts. This includes private, draft, pending, trashed, and password-protected posts.
2
Does exploitation require an account or user interaction?
No. The affected AJAX action is available without authentication or authorization, and exploitation does not require user interaction.
3
Which plugin versions are affected?
MPCX Lightbox versions 1.2.2 through 1.2.5 are affected.