Authorization Flaw in CubeWP Framework Plugin for WordPress
CVE-2026-17018

Currently unrated

Key Information:

Vendor

WordPress
Status
CubeWP Framework
Vendor
CVE Published:
10 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-17018?

The CubeWP Framework for WordPress, up to version 1.1.30, has a significant vulnerability that lacks proper authorization checks for reading object metadata via one of its REST API endpoints. This oversight allows users with the Contributor role and above to access and read arbitrary metadata associated with posts, including those that are private, pending, or password-protected. Furthermore, it exposes user metadata for any account, potentially including sensitive information for site administrators. Website owners using this plugin should take immediate action to implement security measures to prevent unauthorized data access.

Affected Version(s)

CubeWP Framework 0 <= 1.1.30

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-17018 - Proof of Concept

References

https://wpscan.com/vulnerability/df87c8d0-b3f3-4995-ac95-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muni Nitish Kumar Yaddala
WPScan
.