Information Exposure Vulnerability in Bread Plugin for WordPress

CVE-2026-4792

What is CVE-2026-4792?

The Bread plugin for WordPress is susceptible to an information exposure vulnerability that enables unauthenticated users to access sensitive configuration settings. This issue arises from inadequate authentication and authorization checks in the settings export functionality, particularly within the download_settings function. This function is triggered on the plugins_loaded hook and is accessible on public pages, allowing attackers to exploit the /?export-meeting-list=1 endpoint. As a result, all plugin configuration settings, including sensitive data such as the protection password stored in plaintext, can be compromised.

References