CVE-2026-13339

Name of the Vulnerable Software and Affected Versions CubeWP Framework versions prior to 1.1.31

Description The CubeWP Framework plugin for WordPress contains a Directory Traversal flaw within the cubewp get svg content() function. This issue allows unauthenticated attackers to read arbitrary files from the server, potentially exposing sensitive information. The flaw is exploitable because the required nonce is publicly emitted in the markup of pages using the CubeWP posts shortcode or widget with AJAX loading enabled, allowing guest visitors to harvest it before sending the AJAX request via the prev icon or next icon parameters.

Recommendations Update the plugin to a version later than 1.1.30. As a temporary mitigation, disable AJAX loading for CubeWP posts shortcodes or widgets to prevent the public emission of the nonce.