CVE-2026-16557 Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...

CVE-2026-16557

The Nimble Page Builder WordPress plugin through 3.3.8 has a missing authorization check in its AJAX handler sek_get_nimble_content_for_seo_plugins , which returns page-builder content without verifying the requesting user's permissions. This allows any authenticated user with the lowest role (Su...