Cubewp Framework

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:cubewp_framework:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUnknown (668ca391-a6cc-5e33-879b-83885214de33)
ProductCubewp Framework (4b9b4639-690c-5a3e-9296-3bb9379867f3)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-17018 vulnerable 2026-09-16 04:33:04.002042 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
Published: 2026-08-10T06:00:13.787Z
Updated: 2026-08-11T20:18:50.184Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-17017 vulnerable 2026-09-16 04:33:03.115318 CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.
Published: 2026-08-09T06:00:14.438Z
Updated: 2026-08-10T19:14:20.675Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.