CVE-2025-12129: falha de média gravidade em cubewp1211 CubeWP Framework
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
cubewp1211 · CubeWP FrameworkCVEs relacionadas — cubewp1211 CubeWP Framework
No mesmo produto, das mais perigosas para as menos.
CVE-2026-13339HIGHCubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon ParameterEPSS 0.9%CVE-2025-4315HIGHCubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2026-6453MEDIUMCubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' ParameterEPSS 0.5%CVE-2025-6461MEDIUMCubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.phpEPSS 0.2%CVE-2025-8615MEDIUMCubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy ShortcodeEPSS 0.2%