CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) contains a broken access control vulnerability on one of its REST API endpoints . The root cause is a lack of per-object read authorization checks and insufficient restrictions on requested metadata keys . This flaw allows users wit...