CVE-2026-9183 describes an information exposure vulnerability in the 24liveblog live blog tool plugin for WordPress. The vulnerability arises from the lb24_block_enqueue_scripts() function, which is hooked to enqueue_block_editor_assets. For non-administrator users, the function loads sensitive 24liveblog integration secrets (lb24_token, lb24_refresh_token, lb24_uid, lb24_uname) from the WordPress options table and exposes them through wp_localize_script() as a JavaScript object (lb24BlockData). This allows authenticated users with contributor-level permissions or higher to extract third-party account credentials by opening the block editor and inspecting the page source. The vulnerability affects versions up to and including 2.2. No official patch or remediation level has been provided by the vendor as of the publication date.

An attacker with contributor-level or higher access to a WordPress site using the vulnerable 24liveblog plugin can obtain sensitive third-party 24liveblog account credentials, including API tokens and refresh tokens. This exposure could lead to unauthorized use of the 24liveblog integration, potentially compromising the confidentiality of the third-party account. The vulnerability does not affect availability or integrity directly and requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 24liveblog plugin if sensitive integration credentials are at risk. Monitor vendor channels for updates or patches addressing this issue.