CVE-2026-16960: CWE-200 Information Exposure in Loops & Logic
Affects Loops & LogicSource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 10/25/2026, 04:40:11 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Loops & Logic | Affected
| Fixed in
|
AI-suggested
Until an official fix is released, restrict access to the plugin's public template-data action if possible or disable the plugin to prevent unauthorized data exposure.
Description
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Impact
Unauthenticated attackers can access sensitive user information and site configuration data that should be protected. This exposure may facilitate further attacks such as targeted phishing or privilege escalation attempts, depending on the exposed data. However, there is no evidence of active exploitation in the wild at this time.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.