CVE-2026-13339 is a directory traversal vulnerability (CWE-22) in the CubeWP Framework WordPress plugin affecting all versions up to 1.1.30. The vulnerability exists in the 'cubewp_get_svg_content' function, which does not properly restrict pathname inputs, allowing attackers to read arbitrary files on the server. The attack can be performed by unauthenticated users because the nonce required for the AJAX request is publicly available in the page markup when the CubeWP posts shortcode or widget is used with AJAX loading enabled. This exposure allows any guest visitor to harvest the nonce and exploit the vulnerability without authentication.

An unauthenticated attacker can read arbitrary files on the server hosting the vulnerable CubeWP Framework plugin. This can lead to disclosure of sensitive information, potentially including configuration files, credentials, or other private data. The vulnerability does not allow modification or denial of service but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to disable AJAX loading in the CubeWP posts shortcode or widget to prevent nonce exposure and reduce attack surface. Monitor vendor channels for updates and apply official fixes once released.