4.3
Moyenne
CVE-2026-16557 The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning…
Description
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Nimble Page Builder 3.3 | premières → 3.3.8 | Pas de correctif indiqué |