The CubeWP – All-in-One Dynamic Content Framework plugin exposes sensitive post content through its AJAX search endpoint, class-cubewp-search-ajax-hooks.php. The flaw allows attackers to retrieve password-protected, private, or draft posts without authentication, leading to a breach of confidentiality. The weakness is a classic information exposure problem, mapped to CWE‑200, and can result in the disclosure of content that administrators expected to remain hidden.

The vulnerability affects the CubeWP Framework, version 1.1.27 and all earlier releases. WordPress sites that have the CubeWP plugin installed in any of these versions are at risk unless a later version is applied.

With a CVSS score of 4.3 the severity is medium, and an EPSS score below 1% indicates that the exploit probability is currently low. The flaw is not yet listed in the CISA KEV catalog. Attackers can exploit this by making unauthenticated HTTP requests to the search endpoint, which does not perform sufficient authorization checks on the requested posts.