Skip to content
Sign in
4.3 Medium

CVE-2026-16557 The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning…

Description

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.

Affected products and versions

Product Affected versions Fixed in
Nimble Page Builder 3.3 earliest → 3.3.8 No fix stated

Other CVEs of Nimble Page Builder

The 2 CVEs of Nimble Page Builder →
CVE-2022-0314 The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter… Not rated
Track this CVE