CVE-2026-0717: LottieFiles WordPress Plugin Info Disclosure

CVE-2026-0717 Overview

The LottieFiles – Lottie block for Gutenberg plugin for WordPress contains a Sensitive Information Exposure vulnerability in all versions up to and including 3.0.0. The vulnerability exists in the /wp-json/lottiefiles/v1/settings/ REST API endpoint, which allows unauthenticated attackers to retrieve sensitive account credentials from the site owner's LottieFiles.com account. This includes the API access token and email address when the "Share LottieFiles account with other WordPress users" option is enabled.

Critical Impact

Unauthenticated attackers can retrieve LottieFiles.com account credentials including API access tokens and email addresses, potentially leading to account takeover and further malicious activities.

Affected Products

• LottieFiles – Lottie block for Gutenberg plugin for WordPress versions up to and including 3.0.0
• WordPress sites with the "Share LottieFiles account with other WordPress users" option enabled
• LottieFiles.com accounts linked to vulnerable WordPress installations

Discovery Timeline

• 2026-01-14 - CVE CVE-2026-0717 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2026-0717

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in the REST API implementation of the LottieFiles plugin, specifically in how the /wp-json/lottiefiles/v1/settings/ endpoint handles authentication and authorization checks.

When the plugin's account sharing feature is enabled, the endpoint fails to properly verify that the requesting user has appropriate permissions before returning sensitive configuration data. This allows any unauthenticated user who can reach the WordPress REST API to query this endpoint and retrieve the stored LottieFiles.com credentials.

The vulnerability requires no authentication and can be exploited remotely over the network. However, the scope is limited to the confidentiality of the LottieFiles account credentials rather than full system compromise, and exploitation requires that the specific account sharing option be enabled in the plugin settings.

Root Cause

The root cause of this vulnerability is improper access control implementation in the plugin's REST API endpoint handler. The common.php file in the LottieFiles plugin fails to implement proper permission checks before exposing sensitive settings data through the REST API. The endpoint should verify that the requesting user has administrative privileges before returning account credentials, but instead returns this data to any requester when the sharing option is enabled.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by:

1. Identifying WordPress sites running the vulnerable LottieFiles plugin
2. Making a direct HTTP GET request to the /wp-json/lottiefiles/v1/settings/ endpoint
3. If the "Share LottieFiles account with other WordPress users" option is enabled, the endpoint returns the stored credentials
4. The attacker obtains the LottieFiles.com API access token and associated email address

With the exposed API token and email address, an attacker could potentially access the victim's LottieFiles.com account, view or modify animations, or use the credentials for further attacks such as credential stuffing or phishing campaigns. For technical details, see the WordPress LottieFiles Source Code in the WordPress plugin repository.

Detection Methods for CVE-2026-0717

Indicators of Compromise

• Unusual GET requests to /wp-json/lottiefiles/v1/settings/ from external IP addresses
• Multiple requests to the LottieFiles settings endpoint from non-authenticated sessions
• Unauthorized access or modifications to connected LottieFiles.com accounts
• Suspicious API activity logged in LottieFiles.com account dashboard

Detection Strategies

• Monitor WordPress access logs for requests to /wp-json/lottiefiles/v1/settings/ from unauthenticated users
• Implement web application firewall (WAF) rules to alert on enumeration attempts against REST API endpoints
• Review LottieFiles.com account activity for unauthorized API token usage
• Deploy endpoint detection solutions to monitor for bulk REST API scanning activity

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints to capture request metadata
• Set up alerts for authentication failures or unusual access patterns to plugin-specific API routes
• Monitor outbound connections from your WordPress installation for signs of credential exfiltration
• Implement rate limiting on REST API endpoints to slow down reconnaissance attempts

How to Mitigate CVE-2026-0717

Immediate Actions Required

• Disable the "Share LottieFiles account with other WordPress users" option in the LottieFiles plugin settings immediately
• Update the LottieFiles plugin to the latest patched version as soon as it becomes available
• Regenerate API access tokens for any LottieFiles.com accounts that may have been exposed
• Review access logs for any suspicious requests to the vulnerable endpoint

Patch Information

Organizations should monitor the official WordPress plugin repository for an updated version of the LottieFiles plugin that addresses this vulnerability. Until a patch is available, the recommended mitigation is to disable the account sharing feature. Additional vulnerability details are available from Wordfence Vulnerability Intelligence.

Workarounds

• Disable the "Share LottieFiles account with other WordPress users" option to prevent credential exposure
• Restrict access to WordPress REST API endpoints using .htaccess rules or server configuration
• Implement IP-based access controls to limit who can query REST API endpoints
• Consider temporarily deactivating the LottieFiles plugin until a patched version is available

# Apache .htaccess rule to restrict access to the vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/lottiefiles/v1/settings/ [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.100$
RewriteRule .* - [F,L]
</IfModule>