CVE-2026-87848

Name of the Vulnerable Software and Affected Versions MPCX Lightbox versions 1.2.2 through 1.2.5

Description An AJAX action available to unauthenticated users lacks authorization and authentication. Additionally, the plugin fails to verify the status of the requested post. This allows unauthenticated visitors to retrieve the title, content, or excerpt of arbitrary posts, including those that are private, draft, pending, trashed, or password-protected, leading to sensitive information exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.