7.5
High
CVE-2026-16960 The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a…
Description
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Loops & Logic 4.3 | earliest → < 4.3.0 | 4.3.0 |