PT-2026-95751 · WordPress · Nimble Page Builder
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Nimble Page Builder WordPress plugin versions prior to 3.3.9
Description
An authorization check is missing when returning page-builder content through an authenticated AJAX action. This allows any authenticated user with Subscriber level permissions or higher to disclose the page-builder content of arbitrary non-public posts and pages, including those with draft, pending, private, or scheduled status.
Recommendations
Update the Nimble Page Builder WordPress plugin to version 3.3.9 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nimble Page Builder