CVE-2026-16557: Nimble Page Builder Information Disclosure

CVE-2026-16557 Overview

CVE-2026-16557 is an information disclosure vulnerability in the Nimble Page Builder WordPress plugin through version 3.3.8. The plugin exposes an authenticated AJAX action that returns page-builder content without performing an authorization check. Any authenticated user with Subscriber-level access or higher can retrieve the page-builder content of arbitrary non-public posts and pages, including drafts, pending, private, and scheduled entries. The flaw is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact

Authenticated low-privilege users can read draft, private, pending, and scheduled page-builder content that site owners intended to keep confidential.

Affected Products

• Nimble Page Builder WordPress plugin versions up to and including 3.3.8
• WordPress sites permitting Subscriber-level registration with the plugin active
• Multi-author WordPress deployments using Nimble Page Builder for unpublished content

Discovery Timeline

• 2026-09-19 - CVE-2026-16557 published to the National Vulnerability Database
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-16557

Vulnerability Analysis

The vulnerability exists in an authenticated AJAX endpoint exposed by Nimble Page Builder. The handler returns serialized page-builder content for a caller-supplied post identifier. It does not validate whether the requesting user has permission to read the target post.

WordPress differentiates between published and non-public post statuses such as draft, pending, private, and future. Access to non-public content normally requires capabilities like read_private_posts or ownership of the post. This plugin skips that check entirely.

A Subscriber account, which is the lowest privileged authenticated role, can iterate through post IDs and extract editorial content that has not yet been released. The disclosed data may include unpublished announcements, embargoed material, private client pages, and staged marketing content.

Root Cause

The root cause is a missing authorization check in the AJAX handler that serves page-builder content. The endpoint authenticates the caller through the standard wp_ajax_ hook but never calls current_user_can() or verifies post ownership before returning the payload. Authentication is conflated with authorization.

Attack Vector

Exploitation requires a valid authenticated session at the Subscriber role or higher. The attacker sends a crafted request to the WordPress admin-ajax.php endpoint targeting the vulnerable action, supplying the post ID of a non-public entry. The server returns the page-builder content directly in the response body. No user interaction, elevated privileges, or complex exploitation chain is required. Refer to the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-16557

Indicators of Compromise

• Repeated POST requests to /wp-admin/admin-ajax.php from Subscriber-level accounts referencing Nimble Page Builder actions
• AJAX responses containing serialized page-builder content for post IDs the requester does not own
• Sequential enumeration of post_id parameter values from a single authenticated session
• Unexpected access patterns from newly registered Subscriber accounts targeting admin-ajax.php

Detection Strategies

• Correlate authenticated AJAX traffic with the requesting user's WordPress role and post ownership metadata
• Flag responses from admin-ajax.php that return non-public post content to non-privileged roles
• Baseline normal AJAX action volume per user role and alert on outliers indicative of enumeration

Monitoring Recommendations

• Enable WordPress access logging with per-user attribution and forward to a centralized SIEM
• Monitor for spikes in Subscriber account registrations followed by AJAX activity
• Review web application firewall telemetry for high-volume requests targeting Nimble Page Builder AJAX actions

How to Mitigate CVE-2026-16557

Immediate Actions Required

• Update Nimble Page Builder to a version later than 3.3.8 once the vendor publishes a patched release
• Audit existing Subscriber and higher accounts for unexpected activity against admin-ajax.php
• Disable open user registration on sites that do not require it to reduce the attacker pool
• Rotate or unpublish sensitive draft content that may have been exposed prior to remediation

Patch Information

As of the last NVD update on 2026-09-21, no fixed version is enumerated in the advisory. Site administrators should monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a release addressing the missing authorization check.

Workarounds

• Deactivate Nimble Page Builder on production sites until a fixed release is available
• Restrict access to /wp-admin/admin-ajax.php for the vulnerable action through a web application firewall rule
• Enforce role-based access controls that prevent Subscriber accounts from reaching plugin AJAX handlers
• Move sensitive unpublished content to a separate staging environment that does not expose the plugin

# Example WAF rule concept: block Subscriber-role requests to the vulnerable AJAX action
# Consult the WPScan advisory for the exact action name before deploying
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026165570,msg:'Block Nimble Page Builder unauthorized AJAX'"
  SecRule ARGS:action "@rx ^(nimble|sek)_" "t:lowercase"