CVE-2025-6461

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6461", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-20T21:47:28.635Z", "datePublished": "2026-01-25T02:22:37.167Z", "dateUpdated": "2026-04-08T16:35:33.685Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:33.685Z"}, "affected": [{"vendor": "cubewp1211", "product": "CubeWP Framework", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.27", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "title": "CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0edb6b7c-8a78-44b9-a5d6-b4a563c92484?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/modules/search/class-cubewp-search-ajax-hooks.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-08-01T03:24:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-24T13:59:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T17:36:56.241582Z", "id": "CVE-2025-6461", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T17:37:01.515Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "CubeWP \u2013 All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "cubewp1211", "product": "CubeWP Framework", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.1.27"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-01T03:24:49.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-24T13:59:04.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0edb6b7c-8a78-44b9-a5d6-b4a563c92484?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/modules/search/class-cubewp-search-ajax-hooks.php"}], "descriptions": [{"lang": "en", "value": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-25T02:22:37.167Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6461", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T17:36:56.241582Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-01-26T17:36:58.720Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-6461", "state": "PUBLISHED", "dateUpdated": "2026-01-25T02:22:37.167Z", "dateReserved": "2025-06-20T21:47:28.635Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-25T02:22:37.167Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CubeWP Framework", "vendor": "cubewp1211", "versions": [{"lessThanOrEqual": "1.1.27", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to."}, {"lang": "es", "value": "El plugin CubeWP \u2013 All-in-One Dynamic Content Framework para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n en todas las versiones hasta la 1.1.27, inclusive, a trav\u00e9s de la funci\u00f3n de b\u00fasqueda en class-cubewp-search-ajax-hooks.php debido a restricciones insuficientes sobre qu\u00e9 publicaciones pueden ser incluidas. Esto permite a atacantes no autenticados extraer datos de publicaciones protegidas con contrase\u00f1a, privadas o en borrador a las que no deber\u00edan tener acceso."}], "id": "CVE-2025-6461", "lastModified": "2026-06-17T10:01:56.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6461", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T17:36:56.241582Z", "version": "2.0.3"}}]}, "published": "2026-01-25T03:15:51.287", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3422640/cubewp-framework/trunk/cube/modules/search/class-cubewp-search-ajax-hooks.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0edb6b7c-8a78-44b9-a5d6-b4a563c92484?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:36:04.069813+00:00", "value": {"mitigation_remediation": ["Upgrade the CubeWP Framework to version 1.1.28 or later, where the search AJAX hooks enforce proper visibility checks", "Disable the AJAX search feature or restrict the endpoint to authenticated users with appropriate capabilities", "Adjust the plugin settings to limit search output to publicly accessible posts only"], "summary": {"action": "Apply Patch", "impact": "Unauthenticated information disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the CubeWP Framework, version 1.1.27 and all earlier releases. WordPress sites that have the CubeWP plugin installed in any of these versions are at risk unless a later version is applied.", "description_and_impact": "The CubeWP \u2013 All-in-One Dynamic Content Framework plugin exposes sensitive post content through its AJAX search endpoint, class-cubewp-search-ajax-hooks.php. The flaw allows attackers to retrieve password-protected, private, or draft posts without authentication, leading to a breach of confidentiality. The weakness is a classic information exposure problem, mapped to CWE\u2011200, and can result in the disclosure of content that administrators expected to remain hidden.", "risk_and_exploitability": "With a CVSS score of 4.3 the severity is medium, and an EPSS score below 1% indicates that the exploit probability is currently low. The flaw is not yet listed in the CISA KEV catalog. Attackers can exploit this by making unauthenticated HTTP requests to the search endpoint, which does not perform sufficient authorization checks on the requested posts."}}}}, "created": "2026-01-26T11:48:09.834075+00:00", "updated": "2026-04-22T15:45:20.869310+00:00", "vendors": ["cubewp", "cubewp$PRODUCT$cubewp", "wordpress", "wordpress$PRODUCT$wordpress"]}