CubeWP – All-in-One Dynamic Content Framework, CVE-2025-6461

CVE, Research URL: CVE-2025-6461
Home page URL: Security reports for CubeWP – All-in-One Dynamic Content Framework
Application: CubeWP – All-in-One Dynamic Content Framework
Published on: Jan 25, 2026
Research Description: The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Affected versions: max 1.1.28.
Status: vulnerable

CubeWP &#8211; All-in-One Dynamic Content Framework, CVE-2025-6461