CubeWP – All-in-One Dynamic Content Framework, a WordPress plugin, exposes sensitive post data through two REST API endpoints: /cubewp-posts/v1/query-new and /cubewp-posts/v1/query. The flaw stems from insufficient access controls, allowing an attacker to read the content of password‑protected, private, or draft posts that should be hidden. This vulnerability is classified under CWE‑200 Information Exposure and results in confidentiality loss without affecting system integrity or availability.

The defect applies to all installations running CubeWP Framework versions 1.1.27 or older. Any WordPress site with the plugin enabled and containing protected or unpublished posts is susceptible, regardless of the site’s overall content visibility settings.

The CVSS score of 5.3 denotes medium severity. The EPSS score of less than 1% indicates a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network‑based, as the vulnerable REST API can be accessed publicly without credentials. An unauthenticated attacker with network access to the site can invoke the exposed endpoints and extract hidden data, leading to confidentiality compromise. No active exploitation is documented, but the flaw remains a valid concern for sites handling sensitive content.