WordPress Plugin Vulnerabilities

Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

Description

The plugin does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

Proof of Concept

Affects Plugins

Plugin icon
tangible-loops-and-logic
Fixed in 4.3.0

References

CVE
CVE-2026-16960

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Philipp Doblhofer
Submitter
Philipp Doblhofer
Submitter website
https://www.codeaware.at
Verified
Yes
WPVDB ID
70344f9a-065d-4611-b958-0297af6f2c63

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2026-04-07
Title
Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint
Published
2022-08-01
Title
Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing
Published
2024-07-26
Title
Campaign Monitor for WordPress < 2.8.16 - Unauthenticated Full Path Disclosure
Published
2025-04-11
Title
Developer Toolbar <= 1.0.3 - Unauthenticated Information Exposure
Published
2025-12-03
Title
WebP Express < 0.25.11 - Unauthenticated Information Exposure