CVE-2026-17018

Name of the Vulnerable Software and Affected Versions CubeWP Framework WordPress plugin versions prior to 1.1.31

Description An issue exists where a REST API endpoint fails to perform per-object read authorization checks and does not restrict the metadata keys that can be requested. This allows users with the Contributor role or higher to read arbitrary post metadata, including draft, pending, private, and password-protected posts belonging to other users, as well as arbitrary user metadata for any user, including administrators.

Recommendations Update CubeWP Framework WordPress plugin to version 1.1.31 or later.