CVE-2026-13339Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-13339 The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function.… https://www.cve.org/CVERecord?id=CVE-2026-13339 ----- Traducción: CVE-2026-13339 El … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑13339, detailing a directory traversal issue in the CubeWP Framework plugin for WordPress with affected versions and the vulnerable function.
0000044
96 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-13339 The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function.… https://www.cve.org/CVERecord?id=CVE-2026-13339
Post summary
The CubeWP Framework plugin (≤ 1.1.30) is vulnerable to directory traversal through the cubewp_get_svg_content function, as disclosed in CVE‑2026‑13339.
00000911
57.9K followersView on X

Explore more

Back to dashboard