CVE-2026-4792: Bread WordPress Plugin Information Disclosure

CVE-2026-4792 Overview

The Bread plugin for WordPress contains an information exposure vulnerability affecting all versions up to and including 2.9.12. The flaw resides in the download_settings function, which is registered on the plugins_loaded hook and explicitly permits execution on non-admin, public pages. Because the function lacks authentication and authorization checks, unauthenticated attackers can trigger a settings export by requesting the /?export-meeting-list=1 endpoint. The exported payload includes every plugin configuration setting, including the protection_password field stored in plaintext. This exposes the PDF protection password intended to restrict access to generated meeting list documents.

Critical Impact
Unauthenticated remote attackers can retrieve the plaintext PDF protection password from any WordPress site running a vulnerable Bread plugin version.

Affected Products

WordPress Bread plugin versions up to and including 2.9.12
Sites using Bread's PDF protection password feature
WordPress installations exposing the /?export-meeting-list=1 endpoint publicly

Discovery Timeline

2026-09-19 - CVE-2026-4792 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-4792

Vulnerability Analysis

The vulnerability is classified as Missing Authorization [CWE-862]. The Bread plugin registers the download_settings function on the plugins_loaded WordPress hook. This hook fires early in the request lifecycle for every request, including those from unauthenticated visitors. The function includes no capability check, no nonce validation, and no authentication gate before serving plugin settings.

When the request parameter export-meeting-list=1 is present, the handler serializes the plugin's configuration and returns it to the caller. The exported dataset contains the protection_password value in cleartext rather than as a hash or encrypted blob. This design converts an administrative export feature into a public disclosure endpoint.

Root Cause

The root cause is the combination of two design decisions: registering a sensitive export handler on a hook that executes for public requests, and storing credential material in plaintext within plugin options. Neither current_user_can() nor a nonce verification call gates the export path, so any HTTP client can invoke it.

Attack Vector

Exploitation requires only an unauthenticated HTTP GET request to the target site. An attacker sends a request to https://target/?export-meeting-list=1 and parses the response for the protection_password field. No user interaction, session, or privilege is required. The exposed password can then be used to unlock protected PDF meeting lists generated by the plugin.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Analysis for the vulnerable code path.

Detection Methods for CVE-2026-4792

Indicators of Compromise

HTTP GET requests containing the query string export-meeting-list=1 from unauthenticated sources
Web server access logs showing responses returning plugin settings payloads to non-admin IP addresses
Unusual outbound traffic to WordPress sites from scanning infrastructure targeting the Bread plugin endpoint

Detection Strategies

Search web server and WAF logs for any request URI matching export-meeting-list=1 and correlate with the requester's authentication state
Alert on response bodies from WordPress endpoints that contain the string protection_password in cleartext
Inventory WordPress installations to identify any deployment of the Bread plugin at version 2.9.12 or earlier

Monitoring Recommendations

Enable verbose access logging on WordPress front-end web servers and forward logs to a centralized analytics platform
Deploy a WAF rule that blocks or flags requests containing the export-meeting-list parameter until the plugin is patched
Monitor plugin version telemetry across the estate and alert when vulnerable versions of Bread are detected

How to Mitigate CVE-2026-4792

Immediate Actions Required

Identify all WordPress sites running the Bread plugin and confirm the installed version
Update the Bread plugin to a version later than 2.9.12 as soon as a patched release is available
Rotate any PDF protection_password values that were previously configured, since they may already be exposed
Block requests containing export-meeting-list=1 at the WAF or reverse proxy layer until patching is complete

Patch Information

The vulnerability affects Bread plugin versions up to and including 2.9.12. Site administrators should consult the Wordfence Vulnerability Report for the latest patched version guidance and apply the update through the WordPress plugin management interface.

Workarounds

Deactivate the Bread plugin until a fixed version is installed if the PDF protection feature is not business-critical
Add a web server or WAF rule that returns HTTP 403 for any request containing the export-meeting-list query parameter
Restrict access to the WordPress site by IP allowlist where feasible to reduce exposure to unauthenticated internet scanners

bash

# Example nginx rule to block the vulnerable endpoint
if ($arg_export-meeting-list) {
    return 403;
}