CVE-2026-16960 is an information exposure vulnerability (CWE-200) in the Loops & Logic WordPress plugin versions prior to 4.3.0. The plugin's public template-data action fails to enforce proper access controls, enabling unauthenticated attackers to read arbitrary user records and site options that should be restricted. This can lead to leakage of sensitive user information such as email addresses and roles. No CVSS score or detailed vendor advisory is currently available, and no patch or remediation guidance has been provided yet.

Unauthenticated attackers can access sensitive user information and site configuration data that should be protected. This exposure may facilitate further attacks such as targeted phishing or privilege escalation attempts, depending on the exposed data. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's public template-data action if possible or disable the plugin to prevent unauthorized data exposure.