CVE-2026-13339: The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13339
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-13339 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for CubeWP Framework plugin
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
More from NVD Recent CVEs
- criticalCVE-2026-8457: The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in a…2026-08-02
- highCVE-2026-18352: The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versi…2026-08-02
- unknownCVE-2026-17002: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.2026-08-01
- unknownCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…2026-08-01
- unknownCVE-2026-55735: Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticat…2026-08-01