The CVE arises from a missing authorization check on a REST API endpoint in CubeWP Framework through v1.1.30. An authenticated user with Contributor privileges or higher can query that endpoint for metadata keys without per-object read restrictions, allowing her to read any post’s metadata—including draft, pending, private, and password‑protected content—and any user’s metadata, including administrators. The flaw results in information disclosure to roles that normally should not have access to such data.

Affected systems are installations of CubeWP Framework version 1.1.30 or earlier. The vulnerability is present whenever the plugin is active, regardless of the specific WordPress installation, because the code path is always reachable as part of the default API set. No specific WordPress version constraints are indicated, so all sites that have upgraded to 1.1.30 or earlier and have not applied a newer version are potentially exposed.

The likelihood of exploitation is facilitated by the fact that the API requires only standard authentication and does not perform per-object checks. A Contributor or Administrator account can invoke the endpoint and obtain sensitive data. Because the exploit does not need additional privileges, it can be carried out quickly by an internal actor. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog; however, the impact on confidentiality is substantial, so the risk remains high.