Auth bypass in Cubewp Framework

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (13.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 13.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-17018: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

  • Cubewp Framework — versions 0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-17018?
CVE-2026-17018 is a medium-severity vulnerability in Cubewp Framework, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.9/10. Published 2026-08-10.
How severe is CVE-2026-17018?
Medium severity. CVSS v3 base score is 4.9 out of 10.