The CubeWP Framework WordPress plugin versions up to 1.1.27 contain an information exposure vulnerability (CWE-200) due to insufficient access controls on specific REST API endpoints. Specifically, the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query endpoints allow unauthenticated users to retrieve content from posts that are password protected, private, or drafts. This exposure violates intended content access restrictions, potentially leaking sensitive information. The vulnerability is publicly documented with a CVSS 3.1 base score of 5.3, indicating a medium severity impact. No patches or fixes are currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user intervention.

An unauthenticated attacker can access sensitive content from protected or private posts via the vulnerable REST API endpoints. This leads to unauthorized disclosure of information that should be restricted, potentially compromising confidentiality of sensitive data stored in these posts. There is no indication of impact to integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable REST API endpoints if possible, or temporarily deactivate the CubeWP plugin to prevent unauthorized data exposure.