CVE-2025-6461

Name of the Vulnerable Software and Affected Versions CubeWP – All-in-One Dynamic Content Framework versions prior to 1.1.27

Description The CubeWP plugin for WordPress has an information exposure issue. Insufficient restrictions on the search feature in the class-cubewp-search-ajax-hooks.php file allows unauthenticated attackers to access data from password-protected, private, or draft posts that they should not be able to view. The vulnerable search feature allows extraction of sensitive information.

Recommendations Update CubeWP – All-in-One Dynamic Content Framework to a version later than 1.1.27.