{"api_version":"1","generated_at":"2026-08-02T20:38:51+00:00","cve":"CVE-2026-13339","urls":{"html":"https://cve.report/CVE-2026-13339","api":"https://cve.report/api/cve/CVE-2026-13339.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-13339","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-13339"},"summary":{"title":"CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter","description":"The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2026-08-02 00:16:22","updated_at":"2026-08-02 00:16:22"},"problem_types":["CWE-22","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":[{"version":"3.1","source":"security@wordfence.com","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3627738/cubewp-framework","name":"https://plugins.trac.wordpress.org/changeset/3627738/cubewp-framework","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.30/cube/functions/admin-functions.php#L1170","name":"https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.30/cube/functions/admin-functions.php#L1170","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=cve","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13339","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13339","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"cubewp1211","product":"CubeWP Framework","version":"affected 1.1.30 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-06-25T14:16:56.000Z","lang":"en","value":"Vendor Notified"},{"source":"CNA","time":"2026-08-01T10:44:26.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Nhien Pham (nhienit)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"CubeWP Framework","vendor":"cubewp1211","versions":[{"lessThanOrEqual":"1.1.30","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Nhien Pham (nhienit)"}],"descriptions":[{"lang":"en","value":"The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request."}],"metrics":[{"cvssV3_1":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-01T23:29:35.617Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea72320-0e1e-45e3-987d-9ab7eecf1aee?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/cubewp-framework/tags/1.1.30/cube/functions/admin-functions.php#L1170"},{"url":"https://plugins.trac.wordpress.org/changeset/3627738/cubewp-framework"}],"timeline":[{"lang":"en","time":"2026-06-25T14:16:56.000Z","value":"Vendor Notified"},{"lang":"en","time":"2026-08-01T10:44:26.000Z","value":"Disclosed"}],"title":"CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2026-13339","datePublished":"2026-08-01T23:29:35.617Z","dateReserved":"2026-06-25T14:01:39.269Z","dateUpdated":"2026-08-01T23:29:35.617Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-02 00:16:22","lastModifiedDate":"2026-08-02 00:16:22","problem_types":["CWE-22","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"13339","Ordinal":"1","Title":"CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read","CVE":"CVE-2026-13339","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"13339","Ordinal":"1","NoteData":"The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.","Type":"Description","Title":"CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read"}]}}}