Security Alert Summary
The Greenshift 6 animation and page builder blocks plugin for WordPress is reported to expose an automated settings backup file that is publicly accessible. According to the CVE entry, unauthenticated attackers can retrieve that file and extract sensitive configuration data, including a range of third-party API keys.
CVE Details
- CVE ID: CVE-2026-2589
- Affected plugin / component: The Greenshift 6 animation and page builder blocks plugin for WordPress
- Affected versions: All versions up to, and including, 12.8.3
- Published: March 6, 2026, 12:16:14 AM UTC
- Last modified: March 6, 2026, 12:16:14 AM UTC
- CVSS v3.1: Base Score 5.3, Severity MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User Interaction: No authentication required (PR:N); no user interaction required (UI:N)
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE / weakness: CWE-200 (Exposure of Sensitive Information)
Technical Details
The vulnerability is described as a Sensitive Information Exposure where the plugin’s automated Settings Backup is stored in a publicly accessible file. Because that backup file can be retrieved without authentication, an attacker can extract configuration secrets stored in it. The CVE specifically lists API keys that may be present in the backup, including keys for OpenAI, Claude, Google Maps, Gemini, DeepSeek, and Cloudflare Turnstile.
The issue exists due to the backup file being accessible over the web without appropriate access controls or authentication checks. The CVE description does not name specific functions, endpoints, or code paths beyond the automated Settings Backup being publicly available.
Impact is limited to the disclosure of sensitive configuration data contained in the backup file. The CVE does not indicate modification of site content, privilege escalation, or direct availability impact stemming from this exposure.
How This Could Impact Your Website
Consider a typical site team: a site owner who configures third-party integrations, internal staff who manage content and settings, and an external contractor who may deploy or edit pages. If automated backups contain API keys, an unauthenticated actor able to download that backup could obtain keys tied to billing, data access, or service usage.
Practical consequences can include unauthorized use of third-party services (leading to unexpected charges), increased risk of targeted phishing or social engineering using information gleaned from exposed settings, and attackers abusing service integration to probe other linked accounts. The CVE indicates confidentiality impact only; it does not state that site user accounts are directly compromised or that site administration is taken over.
If you9re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review plugin settings and remove any automated backups that are stored in publicly accessible locations until access controls are confirmed.
- Rotate any API keys or credentials that may have been included in backups (OpenAI, Claude, Google Maps, Gemini, DeepSeek, Cloudflare Turnstile, etc.) if you cannot confirm they were never exposed.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other accounts with edit privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your exposure surface.
- Monitor site and third-party service activity for unusual behavior or unexpected billing.
If you9d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
