Executive Summary

The CubeWP Framework plugin for WordPress is vulnerable to a Directory Traversal attack in versions up to and including 1.1.30. This vulnerability, tracked as CVE-2026-13339, allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability has a CVSS score of 7.5, indicating high severity.

Technical Analysis

The vulnerability is located in the 'cubewp_get_svg_content' function of the CubeWP Framework plugin. It is a Directory Traversal vulnerability, classified under CWE-22. The attack vector is network-based (AV:N), with low attack complexity (AC:L), and does not require any privileges (PR:N) or user interaction (UI:N). The vulnerability allows attackers to read arbitrary files on the server, potentially leading to high confidentiality impact (C:H).

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability. The required nonce for the AJAX request is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled. This makes it possible for any guest visitor to harvest the nonce before submitting the AJAX request. The attacker would send a crafted request to the vulnerable function, potentially allowing them to read sensitive files on the server.

Impact Assessment

The vulnerability affects all versions of the CubeWP Framework plugin up to and including 1.1.30. With a CVSS score of 7.5, it is considered a high-severity vulnerability. Successful exploitation could allow an attacker to read sensitive information from files on the server, potentially leading to further attacks.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the CubeWP Framework plugin to a version greater than 1.1.30. Additionally, users should ensure that the plugin is configured to not publicly emit the nonce for AJAX requests, and consider implementing additional security measures such as restricting access to sensitive files or monitoring for suspicious activity.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence