CVE-2026-17018: CubeWP Framework Info Disclosure Flaw

CVE-2026-17018 Overview

CVE-2026-17018 affects the CubeWP Framework WordPress plugin through version 1.1.30. The plugin exposes a REST API endpoint that fails to enforce per-object read authorization and does not restrict which metadata keys clients may request. Authenticated users with the Contributor role or higher can read arbitrary post metadata, including draft, pending, private, and password-protected posts belonging to other users. The same endpoint also returns arbitrary user metadata for any account, including administrators. The flaw is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Low-privileged authenticated users can read sensitive post and user metadata across the entire site, including administrator account data.

Affected Products

CubeWP Framework WordPress plugin versions up to and including 1.1.30
WordPress sites permitting Contributor-level (or higher) registration with CubeWP installed
Any downstream CubeWP-based theme or add-on relying on the vulnerable endpoint

Discovery Timeline

2026-08-10 - CVE-2026-17018 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-17018

Vulnerability Analysis

The CubeWP Framework registers a REST API endpoint intended to return metadata for objects the caller should already be able to view. The handler accepts an object identifier and a metadata key from the request, then returns the corresponding value without validating that the caller has read access to that specific object. It also does not maintain an allowlist of metadata keys that may be queried through the endpoint.

The issue is an Insecure Direct Object Reference. The caller supplies the target post ID or user ID, and the plugin returns metadata directly from the database. Because WordPress post status checks (draft, pending, private, password-protected) and user metadata access controls are enforced elsewhere in core, bypassing them at this endpoint exposes data that WordPress would otherwise hide.

Exploitation requires an authenticated account with Contributor privileges or higher. Sites that allow open registration or that assign Contributor roles for content submission are the most exposed. The confidentiality impact is high; integrity and availability are not affected.

Root Cause

The REST handler trusts client-supplied identifiers and metadata keys. Two controls are missing: a per-object capability check tying the caller to the requested resource, and a server-side allowlist limiting which meta keys are readable through the endpoint.

Attack Vector

An attacker authenticates to the target WordPress site with any role at Contributor or above. The attacker then issues authenticated REST requests to the vulnerable CubeWP endpoint, iterating over post IDs and user IDs while varying the requested metadata key. The endpoint returns metadata values regardless of post status or the requester's relationship to the target user, enabling enumeration of private post contents, user email addresses, password reset tokens if stored in usermeta, and other sensitive fields written by plugins or themes.

See the WPScan Vulnerability Details for additional technical context.

Detection Methods for CVE-2026-17018

Indicators of Compromise

Authenticated REST API requests from Contributor-level accounts to CubeWP endpoints referencing post IDs or user IDs the account does not own
High-volume enumeration patterns against the CubeWP metadata endpoint, particularly requests iterating sequential IDs
Requests supplying sensitive meta keys such as session_tokens, _password, or plugin-specific secret keys

Detection Strategies

Review web server and WordPress access logs for POST or GET traffic to CubeWP REST routes correlated with non-privileged authenticated sessions
Alert on Contributor or Author accounts issuing bursts of REST calls that reference user IDs distinct from their own
Compare accessed meta keys against an expected baseline for the plugin and flag deviations

Monitoring Recommendations

Enable WordPress REST API request logging and forward events to a centralized SIEM for correlation
Track new low-privilege account registrations followed shortly by REST API activity
Monitor for password reset flows or administrative logins that follow suspicious metadata read patterns

How to Mitigate CVE-2026-17018

Immediate Actions Required

Update the CubeWP Framework plugin to a version later than 1.1.30 once the vendor releases a fix
Audit user accounts and remove or downgrade unnecessary Contributor, Author, and Editor roles
Disable open user registration on sites that do not require it, or restrict default roles to Subscriber

Patch Information

No fixed version is published in the NVD record at the time of writing. Consult the WPScan Vulnerability Details advisory for the latest vendor patch status and apply updates as soon as they become available.

Workarounds

Restrict access to the vulnerable REST endpoint at the web server or WAF layer until a patched version is installed
Force re-authentication and rotate credentials for administrator accounts if suspicious metadata reads are observed
Remove the CubeWP Framework plugin temporarily on high-value sites that cannot enforce endpoint-level restrictions

bash

# Example nginx rule to block unauthenticated or low-privilege access to the CubeWP REST namespace
location ~ ^/wp-json/cubewp/ {
    # Require an authenticated session cookie and rate-limit
    limit_req zone=cubewp burst=5 nodelay;
    if ($http_cookie !~* "wordpress_logged_in") { return 403; }
}