CVE-2026-16960
Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
| Vendor | unknown |
| Product | loops & logic |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown loops & logic
Be the first to know when new high vulnerabilities affecting unknown loops & logic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Loops & Logic
0 < 4.3.0
References
Credits
Philipp Doblhofer WPScan