The CVE arises from a missing authorization check on a REST API endpoint in CubeWP Framework through v1.1.30. An authenticated user with Contributor privileges or higher can query that endpoint for metadata keys without per-object read restrictions, allowing them to read any post’s metadata—including draft, pending, private, and password‑protected content—and any user’s metadata, including administrators. The flaw results in information disclosure to roles that normally should not have access to such data.

Affected systems are installations of CubeWP Framework version 1.1.30 or earlier. The vulnerability is present whenever the plugin is active, regardless of the specific WordPress installation, because the code path is always reachable as part of the default API set. No specific WordPress version constraints are indicated, so all sites that have upgraded to 1.1.30 or earlier and have not applied a newer version are potentially exposed.

The likelihood of exploitation is facilitated by the fact that the API requires only standard authentication and does not perform per-object checks. A Contributor or Administrator account can invoke the endpoint and obtain sensitive data. However, the EPSS score is <1 % and the CVSS score of 4.9 reflect moderate severity, and the vulnerability is not listed in the CISA KEV catalog, indicating that the overall risk to the broader community is low to moderate.