Sensitive Information Exposure in Greenshift Animation and Page Builder Plugin for WordPress
CVE-2026-2589

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Greenshift – Animation And Page Builder Blocks
Vendor
CVE Published:
5 March 2026

What is CVE-2026-2589?

The Greenshift Animation and Page Builder plugin for WordPress contains a vulnerability that allows sensitive information to be exposed. Specifically, the automated Settings Backup feature stores sensitive data, such as API keys for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile, in a publicly accessible file. This issue permits unauthenticated attackers to exploit this weakness and extract confidential information, putting website security at risk. Website owners should take immediate action to secure their sites against this vulnerability.

Affected Version(s)

Greenshift – animation and page builder blocks 0 <= 12.8.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3465111/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Quốc Huy
.