7.5
Élevée
CVE-2026-16960 The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a…
Description
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Loops & Logic 4.3 | premières → < 4.3.0 | 4.3.0 |