CVE-2025-6461

MEDIUM 4.3

CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

CWE	CWE-200
Vendor	cubewp1211
Product	cubewp framework
Published	Jan 25, 2026
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for cubewp1211 cubewp framework

Be the first to know when new medium vulnerabilities affecting cubewp1211 cubewp framework are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

cubewp1211 / CubeWP Framework

0 ≤ 1.1.27

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/0edb6b7c-8a78-44b9-a5d6-b4a563c92484?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/modules/search/class-cubewp-search-ajax-hooks.php

Credits

Matthew Rollings