Security Alert Summary
The CubeWP Framework plugin for WordPress contains a directory traversal vulnerability in the cubewp_get_svg_content function that can allow unauthenticated attackers to read arbitrary files on the server. The vulnerability is exploitable because a required nonce is publicly emitted into page markup for the CubeWP posts shortcode or widget when AJAX loading is enabled, making the nonce harvestable by any guest visitor before submitting the AJAX request.
CVE Details
- CVE ID: CVE-2026-13339
- Affected component: CubeWP Framework plugin (vendor: cubewp1211)
- Affected versions: All versions up to and including 1.1.30
- Published: August 2, 2026 at 12:16:22 AM UTC
- Last modified: August 2, 2026 at 12:16:22 AM UTC
- CVSS v3.1: Base score 7.5 – HIGH
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User interaction: None required; unauthenticated attacker; no user interaction required
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness: CWE-22 (Directory Traversal)
Technical Details
The vulnerability is a directory traversal flaw in the cubewp_get_svg_content function. Because the plugin emits a nonce into the markup of any page that renders the CubeWP posts shortcode or the CubeWP widget when AJAX loading is enabled, an unauthenticated guest can harvest that nonce from the page markup. With the nonce available, an attacker can submit the AJAX request that invokes cubewp_get_svg_content and manipulate the request to traverse directories and read arbitrary files on the server. The flaw allows reading file contents only; the provided data does not indicate modification or deletion capabilities.
How This Could Impact Your Website
Consider a site with a site owner, internal staff who manage content, and an external contractor who contributes posts via contributor accounts. An attacker who harvests the publicly emitted nonce could craft requests to read server files that may contain configuration, API keys, or stored user data. Practical consequences include exposure of internal user email addresses or other sensitive details, and an increased risk of targeted phishing or social engineering against staff or contractors based on harvested information. The CVSS data indicates the primary impact is to confidentiality rather than site integrity or availability.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and server logs for unusual behavior related to AJAX requests or file access.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
References
- https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.30/cube/functions/admin-functions.php#L1170
- https://plugins.trac.wordpress.org/changeset/3627738/cubewp-framework
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=cve
