CVE-2026-0717

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0717", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-08T11:59:20.274Z", "datePublished": "2026-01-14T05:28:04.741Z", "dateUpdated": "2026-04-08T16:37:55.879Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:55.879Z"}, "affected": [{"vendor": "lottiefile", "product": "LottieFiles", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled."}], "title": "LottieFiles \u2013 Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lottiefiles/tags/3.0.0/src/common.php?marks=21,122#L21"}, {"url": "https://plugins.trac.wordpress.org/changeset/3442469/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "yoshi cat"}], "timeline": [{"time": "2025-12-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-13T16:45:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T15:45:03.443111Z", "id": "CVE-2026-0717", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:17:15.578Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0717", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T15:45:03.443111Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T15:45:05.785Z"}}], "cna": {"title": "LottieFiles \u2013 Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "yoshi cat"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "lottiefile", "product": "LottieFiles", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-13T16:45:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lottiefiles/tags/3.0.0/src/common.php?marks=21,122#L21"}, {"url": "https://plugins.trac.wordpress.org/changeset/3442469/"}], "descriptions": [{"lang": "en", "value": "The LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:55.879Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0717", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:55.879Z", "dateReserved": "2026-01-08T11:59:20.274Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-14T05:28:04.741Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LottieFiles", "vendor": "lottiefile", "versions": [{"lessThanOrEqual": "3.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled."}, {"lang": "es", "value": "El plugin LottieFiles \u2013 Lottie block para Gutenberg para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 3.0.0, inclusive, a trav\u00e9s del endpoint de la API REST `/wp-json/lottiefiles/v1/settings/`. Esto permite a atacantes no autenticados recuperar las credenciales de la cuenta de LottieFiles.com del propietario del sitio, incluyendo su token de acceso a la API y direcci\u00f3n de correo electr\u00f3nico, cuando la opci\u00f3n 'Compartir cuenta de LottieFiles con otros usuarios de WordPress' est\u00e1 habilitada."}], "id": "CVE-2026-0717", "lastModified": "2026-06-17T10:11:15.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0717", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T15:45:03.443111Z", "version": "2.0.3"}}]}, "published": "2026-01-14T06:15:55.670", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lottiefiles/tags/3.0.0/src/common.php?marks=21,122#L21"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3442469/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19b159ca-4b41-48b4-880d-9b9dc44b3463?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:59:46.178583+00:00", "value": {"mitigation_remediation": ["Update the LottieFiles \u2013 Lottie block for Gutenberg plugin to the latest version that removes or secures the API endpoint.", "Disable the 'Share LottieFiles account with other WordPress users' setting in the plugin\u2019s configuration to prevent credential leakage.", "If an update is not immediately available, block or require authentication for the /wp-json/lottiefiles/v1/settings/ endpoint using a security plugin or web server rule."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "Affected systems include the LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress versions up to and including 3.0.0. Any WordPress site that has installed this plugin and has the sharing option enabled is vulnerable. The vulnerability applies to all installations regardless of user role because the REST endpoint does not enforce authentication.", "description_and_impact": "The LottieFiles \u2013 Lottie block for Gutenberg plugin for WordPress contains a vulnerability that allows unauthenticated users to read sensitive data through the /wp-json/lottiefiles/v1/settings/ REST API endpoint. When the 'Share LottieFiles account with other WordPress users' option is enabled, an attacker can retrieve the site owner's LottieFiles.com account credentials, including the API access token and email address. This flaw is a classic example of a sensitive information exposure (CWE\u2011200) and gives an attacker access to credentials that could be used to control the owner's LottieFiles account or abuse the API.", "risk_and_exploitability": "Risk assessment indicates a CVSS score of 5.3, indicating a moderate severity. The EPSS score is reported as less than 1%, implying a very low likelihood of exploit at this time. The vulnerability is not listed in the CISA KEV catalog. Because the REST endpoint is publicly accessible, an attacker only needs to know the site's URL and may try to query the endpoint; no additional conditions or privileges are required. Therefore the potential impact is the exposure of user credentials and API tokens, but the overall exploit probability remains low."}}}}, "created": "2026-01-14T10:48:55.726533+00:00", "updated": "2026-04-16T08:00:11.209218+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}