CVE-2025-6461: 
WordPress vulnerability analysis and mitigation

CVE-2025-6461 is an Information Exposure vulnerability in the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress, classified under CWE-200. It affects all versions up to and including 1.1.27, allowing attackers to extract data from password-protected, private, or draft posts via the plugin's search feature. The vulnerability was disclosed on January 24, 2026, with Wordfence as the assigning CNA. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient access control in the search feature implemented in class-cubewp-search-ajax-hooks.php, which fails to properly restrict which post types and statuses can be returned in search results (CWE-200). An attacker can send crafted AJAX search requests to the WordPress site to retrieve content from posts that are marked as password-protected, private, or in draft state — content that should be inaccessible to unauthenticated or low-privileged users. The fix is documented in the plugin's SVN changeset, which modifies the search hook logic to enforce proper post visibility restrictions (WordPress Changeset, Wordfence).

Successful exploitation allows unauthenticated or low-privileged attackers to read the content of posts that site owners have intentionally restricted — including password-protected posts, private posts visible only to administrators/editors, and unpublished draft content. This represents a confidentiality breach that could expose sensitive business information, unreleased content, or personal data stored in draft or private posts. There is no impact on integrity or availability, and the scope is limited to the affected WordPress instance (Wordfence).

The CVSS vector indicates the vulnerability requires low privileges (PR:L), meaning an attacker needs at minimum a basic authenticated account on the WordPress site, though the Feedly description notes unauthenticated attackers may also be able to exploit it. No public exploit code or active in-the-wild exploitation has been reported. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the CubeWP – All-in-One Dynamic Content Framework plugin (version ≤ 1.1.27) using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/cubewp-framework/readme.txt.
2. Identify the vulnerable AJAX endpoint: Locate the search AJAX hook registered by class-cubewp-search-ajax-hooks.php, typically accessible via WordPress's standard AJAX handler at wp-admin/admin-ajax.php or a front-end equivalent.
3. Craft a search request: Send an HTTP POST or GET request to the AJAX endpoint with a search query parameter designed to retrieve post content, without specifying post status filters that would normally exclude private/draft/password-protected posts.
4. Extract restricted content: Parse the JSON or HTML response returned by the search feature, which may include titles, excerpts, or full content from posts that should be inaccessible, due to the missing post-status restrictions in the search logic (Wordfence, WordPress Changeset).

• Network: Unusual or repeated HTTP requests to wp-admin/admin-ajax.php with CubeWP search-related action parameters from unexpected IP addresses or at high frequency.
• Logs: WordPress access logs showing search AJAX requests returning HTTP 200 responses for queries that include terms matching private or draft post content; requests originating from unauthenticated sessions (no valid session cookie) targeting the CubeWP search endpoint.
• File System: No file-system artifacts expected for this read-only information disclosure vulnerability; however, monitor for unexpected changes to class-cubewp-search-ajax-hooks.php if the plugin has not been updated.

Update the CubeWP – All-in-One Dynamic Content Framework plugin to version 1.1.28 or later, which includes the fix applied in SVN changeset 3422640 that enforces proper post-status restrictions in the search feature. If an immediate update is not possible, consider disabling the CubeWP search feature or restricting access to the AJAX endpoint via web application firewall rules. Site administrators should also audit whether sensitive content stored in private, draft, or password-protected posts may have been exposed (WordPress Changeset, Wordfence).